User lockout uses the user's lockoutTime property. When you access Active Directory by using the LDAP provider, you can use it to determine the lockout status of the user. If it is larger than zero, the user is currently locked out. To undo the lockout, set the value to zero.

LockoutTime is cleared only when the locked-out user attempts to log on. When the lockout time has expired, but the user has not yet tried to log on, lockoutTime may be still set, although the user would be able to successfully log on at that time.