Note that pwdAccountLockedTime depends on pwdLockout

doc/man/man5/slapo-ppolicy.5

@@ -590,7 +590,10 @@ If the account has been locked, the password may no longer be used to
 authenticate the user to the directory.  If
 .B pwdAccountLockedTime   
 is set to 000001010000Z, the user's account has been permanently locked
-and may only be unlocked by an administrator.
+and may only be unlocked by an administrator. Note that account locking
+only takes effect when the
+.B pwdLockout
+password policy attribute is set to "TRUE".
 .LP
 .RS 4
 (  1.3.6.1.4.1.42.2.27.8.1.17