Machine keeps locking out user account

[kcouto]

A specific workstation keeps locking out a user's edir account. It happens about 3 times a week. Intruder Lockout kicks in after 3 unsuccessful attempts. We also use ldap to authenticate to the Internet. The last intruder Ip address comes from both the workstation and the ldap server. This user will work on another workstation with no problems. I've had this problem before with some other stations and got fed up so I just re-imaged them. The problem went away. It's really bizarre and annoying. Any ideas??

Thanks