Exact process that locks account?

Were you referring to using ALockout.dll within the ALTools?

https://technet.microsoft.com/en-us/library/cc738772%28WS.10%29.aspx The ALockout.dll tool and the Appinit.reg script are included in the ALTools package. ALockout.dll is a logging tool that may help you determine the program or process that is sending the incorrect credentials in an account lockout scenario. The tool attaches itself to a variety of function calls that a process might use for authentication. The tool then saves information about the program or process that is making those calls into the Systemroot\Debug\Alockout.txt file. The events are time stamped so that you can match them to the events that are logged in either the Netlogon log files or the Security event log files.

I want to mention it to make sure it wasn't missed