I wrote an article talk about how to find out which services lockout domain accounts on vCenter Server. It only applies to the scenarios that domain accounts very frequently lockout. Like every 1 second. If it’s minutes, it will be hard to find out as it’s manually processing.
The other way to identify source is to use vSphere Web Client. The trick was told by VMware BCS team.
Log in to vSphere Web Client. Go to the main page and the Events node. Search for “authen” you may see some error events. The real source is red text.
User CONTOSO\firstname.lastname@example.org .....