During any maintenance it is always a discussion about how to track the already locked users.
Most easiest way is SU10. But with this it is difficult to keep track of already locked users.
For ECC systems (Also for S/4HANA), you can do this by using transaction EWZ5.
Note that this is not available for other SAP Applications.
Advantage with this method is that the application sets a flag for already locked users.
You can now select the users who should not be locked (Euro Administrator) and save the transaction.
Click on lock user and all the users are now locked.
Notice the Locked flag is still set for users that were already locked.
If you do not select a euro administrator before locking the users, you will get the below warning message.