Yes, eventcomb built-in search is very helpful, in these cases, but if that
does not help this is a little advanced to go deeper, shows all the NTLM
based lockouts.

I normally do both at the...