samba - Nov 2011 - User authentication log

We've changed the password for the administrator account, once it was 
changed a few minutes later the administrator account locked out, 
Something is set to log in as admin on our network whether it be a share 
set up with those credentials,, not sure at this point..

I'm having trouble finding any logs of failed login attempts, and would 
like some help on getting the proper logging or pointers on what to grep 
for from the logs, or anything that will point me in the right direction 
to find the nodes in questions? I have an openldap backend..

Right now for logging I have

    #log file = /var/log/samba/%m.%U.log
    log file = /var/log/samba/%m.log
    log level = 5

    vfs objects = full_audit
    full_audit:prefix = %u|%I|%m|%S
    full_audit:success = connect mkdir rename rmdir 
#full_audit:success = all
    full_audit:failure = none
    full_audit:facility = LOCAL7
    full_audit:priority = alert


Thank you Very much,
Aaron