So following on my other two posts Who locked me out? and AD Account Lockout is what is probably the last on this subject .. What computer locked me out.
Found this and its shweet: http://serverfault.com/questions/32633/how-to-check-who-is-currently-logged-on-to-windows-workstation-from-command-line
My problem today, was that some donkey was logging on to server using a service account, and getting the password wrong 
and so locking the service account out!
So you can check on the server itself in the security log for event id 529. The hope is that this will show a Source Network Address.
What you can then do is use the following command with the Source Network Address to find the donkey that is using the computer and so locking the account out!
WMIC /NODE: <IP or hostname> COMPUTERSYSTEM GET USERNAME
This should return the username currently logged! How cool is that?!
flaphead.com 