Back in Samba3.x (NT-domain), I used to unlock with "pdbedit -c='[]' <user>", essentially wiping out all Account flags shown by pdbedit -l <user>. I don't know if it works under AD.