AD Audit site:
http://nwb-adaudit:8081 pw is in Bitwarden. *Make sure domain is set to ADAudit Plus Authentication, not ECHART. There are many different avenues to check logs. Here is one:
*Click on Reports Tab > Login failures > Search icon and enter username
Results will show which device is locking them out and the reporting Domain Controller: