Step 4: Check the results

The LockoutStatus tool will show the status of the account on the domain DCs including the DCs which registered the account as locked and, crucially, which DCs recorded a bad password (the 'Bad Pwd Count' column).

The DCs most likely to give the result we need are those reporting one or more bad passwords as listed in the 'Bad Pwd Count' column.

In this example LONDC02 has recorded five bad passwords, however you mustn't make the mistake of not also checking the Security log of, in this case, DC01 in the DR site even though it's only recorded one bad password.