AD users getting locked out every 20 seconds

I have recently done this for myself.

The script can show you the timestamp, username, machine name where the lockout event is being originated.

Here is code:

# Set default parameters and variables
param (
    [string]$DomainName = $env:USERDOMAIN,
    [string]$UserName = "*",
    [datetime]$StartTime = (Get-Date).AddDays(-3)
)

# check if current powershell version is 4 or higher

if ($Host.Version.Major -lt "4") {
    Write-Host "`n`nError: You need at least version 4 PowerShell for logging to work, `nCurrent version:"$Host.Version.Major -BackgroundColor Red -ForegroundColor white
    Write-Host "`nBefore you start using this script, please upgrade your PowerShell from Microsoft website!" -BackgroundColor Yellow -ForegroundColor Black
    Read-Host "`n`nScript execution finished, press enter to exit!"
    Exit
}

# Grab the information about your AD forest
$Forest = [system.directoryservices.activedirectory.Forest]::GetCurrentForest()

# Get list of all domain controllers in the forest
$DC = $Forest.domains | ForEach-Object {$_.DomainControllers} | ForEach-Object {$_.Name}


# Prompt user to enter a pacific username or accept default (which means look for all locked out events)
Write-Host "`n`nEnter a UserName to search user specific locked out events `n`nOR `n`nPress enter to search all locked out usernames!" -BackgroundColor Yellow -ForegroundColor Black
sleep 3

$TestName = Read-Host "`nPlease enter a UserName or Press enter"
if ($TestName -ne $null -and $TestName) {[string]$UserName = $TestName}



Write-Host "`nScript will search for locked out events on the following domain controllers..." -BackgroundColor Gray -ForegroundColor Black
$dc

# Search for locked out event of each DC and store them in variable
$dc | foreach {

    Write-Host "`nChecking for locked out events on $_, please wait..." -BackgroundColor Gray -ForegroundColor Black
    $OutPut = Invoke-Command ($_) {

    $ErrorActionPreference = "SilentlyContinue"
    Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740;StartTime=$Using:StartTime} |
        Where-Object {$_.Properties[0].Value -like "$Using:UserName"} |
        Select-Object -Property TimeCreated, 
            @{Label='UserName';Expression={$_.Properties[0].Value}},
            @{Label='ClientName';Expression={$_.Properties[1].Value}}


    $ErrorActionPreference = "Continue"
    } | Select-Object -Property TimeCreated, 'UserName', 'ClientName' |Out-Host

    if ($OutPut -eq $null -and !$OutPut) {Write-Host "`nWarning: No lockout events were found!`nContinuing the search..." -BackgroundColor Yellow -ForegroundColor Black}
    else {$OutPut}
}