GBTI AD Lockout Investigator - quick start
===========================================
STEP 1: Install Python on the Windows box if not installed:
        https://www.python.org/downloads/  (tick "Add to PATH")

STEP 2: Double-click  BUILD-EXE.bat
        -> creates  GBTI-Lockout-Investigator.exe  in this folder
        (installs ldap3 + dnspython + pyinstaller automatically)

STEP 3: Run GBTI-Lockout-Investigator.exe

LOGIN
-----
Use your gbtiguyana.net admin account:
  administrator@gbtiguyana.net   or   GBTI\administrator
NOTE the domain spelling: .NET  (not .neet)

If Symantec flags the exe, mark it "Trusted"/allow - it is unsigned
because we built it ourselves; it only speaks LDAP to your DCs
(no PowerShell is spawned at all, so EDR heuristics about
powershell abuse do not apply).

WHAT IT DOES
------------
- Login screen: gbtiguyana.net admin credentials (pure LDAP bind)
- Enter a username -> it queries EVERY domain controller for the
  user's badPwdCount and lockoutTime
- Shows which server has the account LOCKED OUT, when it was locked,
  and how many bad password attempts piled up there
- The DC with rising badPwdCount = the lockout origin (usually a
  device with stale credentials: mapped drives, saved passwords,
  phones retrying old passwords)
- Unlock button: clears lockoutTime on the PDC Emulator
  (replicates domain-wide instantly)

REQUIREMENTS
- Network access to domain controllers (LDAP 389/636)
- No PowerShell, no RSAT, no admin PowerShell module needed