Getting account lockout and ip shows as loopback from server.. HELP

All investigation shows its coming from the server and I cant find exactly where..

here is the events info:

4771

Kerberos pre-authentication failed.

Account Information:

Security ID:		#### (redacted domain)\T.Downing

Account Name:		T.Downing

Service Information:

Service Name:		krbtgt/#### (redacted domain)

Network Information:

Client Address:		::1

Client Port:		0

Additional Information:

Ticket Options:		0x40810010

Failure Code:		0x12

Pre-Authentication Type:	0

Certificate Information:

Certificate Issuer Name:		

Certificate Serial Number: 	

Certificate Thumbprint:		

4740

A user account was locked out.

Subject:

Security ID:		SYSTEM

Account Name:		####### (redacted because its my FSMO Server)

Account Domain:		#### (redacted domain)

Logon ID:		0x3E7

Account That Was Locked Out:

Security ID:		#### (redacted domain)T.Downing

Account Name:		T.Downing

Additional Information:

Caller Computer Name:	####### (redacted because its my FSMO Server)