How to identify the source of blocking domain accounts?

Question

Active Directory

There is a suspicion that a password enumerator for domain accounts has started up on the network. In the domain controller logs, the Calling computer name field is either empty or MSTSC, there are no machines with that name on the network, of course. At the same time, information about accounts blocked by ordinary users is displayed correctly.
Are there any third-party solutions that can help identify the problem?

Answer 1

MSTSC is the Windows Terminal Services Client.

Answer 2

Network traffic monitoring (banal Netflow with a web muzzle) / IDS.

Answer 3

I myself encountered this, the reasons were in my own stupidity - on a couple of computers, I allowed some services to start from their own account. After the planned password change of the account, these services could not log in, and, of course, the account was blocked. I found the cause with difficulty.

Answer 4

netwrix account lockout examiner

Answer 5

Account Lockout Examine