Hi GREGD,
Login user to SnapCenter and RunAs account for the host plugin can be different.
You can have an AD user created and add him/her to the system administrator group of the host. You can use this admin user as RunAs for the plugin host. Plugin Installation is expected to go fine without any issues.
The issue that you see of AD account getting locked need to be checked with your network or AD administrator.
This could be the reason why you are getting the error in Modify host page as it is not able to get required administrative rights (locked RunAs ac) for searching the plugins in the host.
From UI user can change the RunAs acc only in the second page (plugin page) of the modify wizard. In your case, you are stuck in the first landing page.
This could possibly be a scenario that the product needs to address. I would suggest you raise a netapp support ticket for this issue.