Hi

With the Code "get-qaduser -locked", i look for user there are been locked

its possible to see on which computer this happen?

#I think you can take a event log message from your DC (if you have logon/logoff logging) using this script
Get-QADUser -Locked | foreach `
{
Get-EventLog Security -ComputerName DC -InstanceId 540 -UserName $_.NTAccountName -Newest 1 | fl message
#or you can see all properties using just fl
}

But be careful if you have two or more DCs user logs only on one of them and event generates on it.

Also it's interesting that when the domain functional level is raised to Windows Server 2008, a new attribute becomes available that reveals the last time a user successfully logged on to a computer, the computer to which the user last logged on, and the number of failed logon attempts since the last logon.