One Active Directory account getting locked when the user unlock the computer

This is a problem for the Active Directory experts.

Since a couple of months, we have a domain account that is getting lock occasionally when the user is coming back from lunch and she is trying to unlock her screen.

We have investigate a lot on this problem and the problem is not related to a service or Schedule task running with saved credential. It is also not related with the user having log on another computer or open a session with rdp.

The folowing security events are register on her local computer at the moment she is trying to unlock her computer:

Nom du journal :Security
Source :       Microsoft-Windows-Security-Auditing
Date :         2014-10-16 15:23:23
ID de l’événement :4625
Catégorie de la tâche :Account Lockout
Niveau :       Information
Mots clés :    Audit Failure
Utilisateur :  N/A
Ordinateur :   SDESJARD1.cmce.ca
Description :
An account failed to log on.

Subject:
      Security ID:            Système
      Account Name:            SDESJARD1$
      Account Domain:            CMCE
      Logon ID:            0x3e7

Logon Type:                  7

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            sdesjard
      Account Domain:            CMCE

Failure Information:
      Failure Reason:            Account locked out.
      Status:                  0xc0000234
      Sub Status:            0x0

Process Information:
      Caller Process ID:      0x1c8
      Caller Process Name:      C:\Windows\System32\winlogon.exe

Network Information:
      Workstation Name:      SDESJARD1
      Source Network Address:      127.0.0.1
      Source Port:            0

Detailed Authentication Information:
      Logon Process:            User32
      Authentication Package:      Negotiate
      Transited Services:      -
      Package Name (NTLM only):      -
      Key Length:            0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
      - Transited services indicate which intermediate services have participated in this logon request.
      - Package name indicates which sub-protocol was used among the NTLM protocols.
      - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
XML de l’événement :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12546</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-16T19:23:23.784888500Z" />
    <EventRecordID>6587</EventRecordID>
    <Correlation />
    <Execution ProcessID="764" ThreadID="812" />
    <Channel>Security</Channel>
    <Computer>SDESJARD1.cmce.ca</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SDESJARD1$</Data>
    <Data Name="SubjectDomainName">CMCE</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">sdesjard</Data>
    <Data Name="TargetDomainName">CMCE</Data>
    <Data Name="Status">0xc0000234</Data>
    <Data Name="FailureReason">%%2307</Data>
    <Data Name="SubStatus">0x0</Data>
    <Data Name="LogonType">7</Data>
    <Data Name="LogonProcessName">User32 </Data>
    <Data Name="AuthenticationPackageName">Negotiate</Data>
    <Data Name="WorkstationName">SDESJARD1</Data>
    <Data Name="TransmittedServices">-</Data>
    <Data Name="LmPackageName">-</Data>
    <Data Name="KeyLength">0</Data>
    <Data Name="ProcessId">0x1c8</Data>
    <Data Name="ProcessName">C:\Windows\System32\winlogon.exe</Data>
    <Data Name="IpAddress">127.0.0.1</Data>
    <Data Name="IpPort">0</Data>
  </EventData>
</Event>

That event will apear the number of time the user tries to unlock the screen.
Notice the logon type is 7, meaning that it is getting locked when the user unlock her screen

On the domain controller security events log, we are getting the following events:

Getting many of the follwoing event

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/16/2014 3:23:23 PM
Event ID:      4771
Task Category: Kerberos Authentication Service
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      SRVAD1.cmce.ca
Description:
Kerberos pre-authentication failed.

Account Information:
      Security ID:            CMCE\sdesjard
      Account Name:            sdesjard

Service Information:
      Service Name:            krbtgt/CMCE

Network Information:
      Client Address:            ::ffff:172.16.29.8
      Client Port:            57989

Additional Information:
      Ticket Options:            0x40810010
      Failure Code:            0x12
      Pre-Authentication Type:      0

Certificate Information:
      Certificate Issuer Name:            
      Certificate Serial Number:       
      Certificate Thumbprint:            

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4771</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>14339</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-16T19:23:23.815617100Z" />
    <EventRecordID>845776691</EventRecordID>
    <Correlation />
    <Execution ProcessID="728" ThreadID="4308" />
    <Channel>Security</Channel>
    <Computer>SRVAD1.cmce.ca</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">sdesjard</Data>
    <Data Name="TargetSid">S-1-5-21-104411000-1224309326-1621235808-31284</Data>
    <Data Name="ServiceName">krbtgt/CMCE</Data>
    <Data Name="TicketOptions">0x40810010</Data>
    <Data Name="Status">0x12</Data>
    <Data Name="PreAuthType">0</Data>
    <Data Name="IpAddress">::ffff:172.16.29.8</Data>
    <Data Name="IpPort">57989</Data>
    <Data Name="CertIssuerName">
    </Data>
    <Data Name="CertSerialNumber">
    </Data>
    <Data Name="CertThumbprint">
    </Data>
  </EventData>
</Event>

The following event occured when the account get locks

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/16/2014 3:23:21 PM
Event ID:      4740
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      SRVAD1.cmce.ca
Description:
A user account was locked out.

Subject:
      Security ID:            SYSTEM
      Account Name:            SRVAD1$
      Account Domain:            CMCE
      Logon ID:            0x3e7

Account That Was Locked Out:
      Security ID:            CMCE\sdesjard
      Account Name:            sdesjard

Additional Information:
      Caller Computer Name:      SDESJARD1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4740</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2014-10-16T19:23:21.132348300Z" />
    <EventRecordID>845776638</EventRecordID>
    <Correlation />
    <Execution ProcessID="728" ThreadID="4308" />
    <Channel>Security</Channel>
    <Computer>SRVAD1.cmce.ca</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">sdesjard</Data>
    <Data Name="TargetDomainName">SDESJARD1</Data>
    <Data Name="TargetSid">S-1-5-21-104411000-1224309326-1621235808-31284</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SRVAD1$</Data>
    <Data Name="SubjectDomainName">CMCE</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
  </EventData>
</Event>

We took the following actions to try to fix the problem:


I am a bit confuse about the lock. It looks like the computer account is getting lock and the user account is also getting locked.

The local event 4625 show the following info:
Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            sdesjard
      Account Domain:            CMCE

The Security ID show "NULL SID", What that mean?
If the domain user account is getting locked, should we see a local event on the computer?

I have parsed all the events and I can't find event that can lead to the culprite.

Any idea is welcome