Do you have accounts defined in more than one domain? Win9x lockouts can occur when account "xyz" exists in more than one trusted domain. When the client connects to a resource, Win9x give the server the account and password hash. The resource server first checks its local SAM then queries all trusted domains. If the server locates a secondary account where the password is not sync'ed a lockout can occur. NT and higher offer a resource server domain\account and password hash avoiding the problem of duplicate accounts.
