I have a user at a school that keeps getting locked out. When I check his account, it appears to have nothing wrong with it. I disable and then enable and he can logon. What logs should I be looking out for and where to find out what he is doing. I have a feeling its incorrect password.