I have an account that keeps getting locked out (a domain account).
I can see when the last bad login occurred and the bad login count = 5. What I want to determine is the IP address of the machine that is responsible for the bad logins.
How can I find this out?
First, auditing of logon failures needs to be enabled. As a matter of practice, I've always put it in an enforced default domain policy, but you should at least have it applied to your domain controllers. The entry is called Audit Account Logon Events, and it only defaults to logging Success for some reason. Info on this setting is available from Microsoft on Technet here.
Once that is enabled, the security logs of the Domain Controller processing the login should contain the necessary information. Specifically, check for Failure Audits of Logon/Logoff Events. The username should be a column called User that you can sort/filter by to ease the search.