unexpected account lockouts

Hi,
At some stage, and for some reason, your users accounts are performing a failed access to some resource - be it either an interactive login or a resource on the network. every time they fail, the bad password count is being incremented untilthe account is locked out as per your domain config. logging out and logging back in is a bit of a red herring, as by that stage the account is locked out anyway - logging in merely shows you that, not causes it. Have a good look at the client machines and see what's running on them, any applications etc that use a network resource, connect automatically and may be providing incorrect details for some reason.... Other than that, you will need to enable auditing (initially I'd try just the win2kserver, then the domain if that gives no joy) and check for failed logons by the next user that has the problem. Bear in mind that this problem is tied to the user account, not the machine, so it's possible that the problem is being caused by a process elsewhere on the domain that is using (or attempting to use) their credentials. Perhaps someone else trying to access a resource using the users accounts? Auditing will allow you to get an idea of where and when the failed access is happening.