We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out.
We are having the same issue, our LDAP service account locks out once a week, authenticating with our DC from our search heads through the lsass.exe process. Have tried figuring out what could cause this and am still working on it.