Q. Why doesn't the read-only domain controller (RODC) GUI show that it locked a user's account after the user entered an incorrect password too many times?

A. By design, RODCs lock user-account access after a designated number of failed password-entry attempts to prevent accounts from being hacked when RODCs lose read-write-DC connectivity. Typically, read-write DCs update multiple attributes with the lockout status. However, RODCs only update the user account's lockoutTime attribute, which reflects the time the account was locked out. The lockoutTime attribute is stored in NT System Time format, which you can convert to normal time with the w32tm /ntte <value> command.

The RODC checks the lockoutTime attribute when a logon attempt is started. If the current time minus the lockoutTime value is less than the lockout-duration configured in the security policy, the RODC won't let the user log in.