Determining cause of account lockout

I have a capture that contains an account lockout occurrence on the machine capturing. We have had issues here with mystery lockouts and some problems determining the cause. Any ideas on how to diagnose aside from "look around the resets from the DC"? Thanks much in advance.