I have noticed my admin account keeps getting locked out because of failed attempts but I don't know from where and how. I tried to dig into logs but didn't find any trace of attempt. 

$ ipa-replica-manage list
Re-run /usr/sbin/ipa-replica-manage with --verbose option to get more information
Unexpected error: Server is unwilling to perform: Too many failed logins.

$ ipa user-show --all admin
  dn: uid=admin,cn=users,cn=accounts,dc=foo,dc=com
  User login: admin
  Last name: Administrator
  Full name: Administrator
  Home directory: /home/admin
  GECOS: Administrator
  Login shell: /bin/bash
  Principal alias: admin@FOO.COM
  UID: 1000
  GID: 1000
  Account disabled: False
  Preserved user: False
  Password: True
  Member of groups: admins, trust admins, no-pwd-policy
  Kerberos keys available: True
  ipauniqueid: 97f5d270-d355-11e6-a809-000c29712463
  krbextradata: AALmz2BfYWRtaW5AVklWT1guQ09NAA==
  krblastadminunlock: 20240509172126Z
  krblastpwdchange: 20200915142958Z
  krblastsuccessfulauth: 20240509172620Z
  krbloginfailedcount: 0
  krbpwdpolicyreference: cn=no-pwd-policy,cn=FOO.COM,cn=kerberos,dc=foo,dc=com
  krbticketflags: 128
  objectclass: top, person, posixaccount, krbprincipalaux, krbticketpolicyaux, inetuser, ipaobject, ipasshuser, ipaSshGroupOfPubKeys

After running following command it do unlock but in few minutes it will get lock again 

$ ipa user-unlock admin