Active Directory User Account Capture

How to trace an AD account lockout issue using wireshark.How to trace the caller computer inside my network

Well, that's not really easy with a network trace, as the account lockout could have a range of possible reasons and the offending system could use LDAP (plaintext) or LDAPS (encrypted via TLS) or Kerberos. As soon as encryption is part of the game (LDAPS or Kerberos), the effort to figure out the problem via a network capture tool, raises fairly fast.

If I had to analyze that kind of problem, I would use built in tools of Windows, like Security Eventlogs, or the 'new' Windows Message Analyzer, rather than a network capture tool.

Regards
Kurt