The best way that I have found is to download the account lockout tools from microsoft.
http://www.microsoft.com/downloads/details.aspx?FamilyID=7af2e69c-91f3-4e63-8629-b999adde0b9e&displaylang=enThis will tell you the originating lockout time and locking domain controller. From there you would actually need to look at the security logs on the domain controller to determine where and what the reason was for the lockout.