I have 2 DC's in a cluster, 2 exchange servers in a cluster and an ISA server.
there is an account in ADUC that keeps getting locked out, as soon as its unticked for Account Locked out, when you hit apply and close the properties box and reopen this its locked again. I don't even try to log the user on and it gets locked out.

the user account is not logged onto any machines in the network, the password has been reset, i have also disabled the account.
i have ran the account lockout tool, it tells me that the account has 5 failed logon attempts.
when i check the security events in event viewer for the time of the lockout it says that the logon attempt is coming from the ISA server.

This has been a previous problem and rebooting the ISA server has resolved the issue for other accounts, however it has not resolved it for this account.

Has anyone come across this before and would know what kind of request is coming from the ISA Server to cause this?
Your help is much appreciated  

is there anyway the ISA server has my credentials cached.
on the pc's we have a proxy set to point to the isa, and we have to put a username and password in before we can get internet access.

does the ISA have a cache of previuos logins or login attempts?

we have web filtering software called surf control