To enable Account lockout synchronization, you need to map attributes accountUnlockTime (Directory Server) and lockoutTime (AD). accountUnlockTime can be selected in the console after loading the schema with passwordObject object class.