Over the past few months we have been encountering random user lockouts in Active Directory while performing an extensive server farm overhaul. As one of the primary sources for help in this small company, I figured I needed to find a way to start troubleshooting the lockout events, without adding to the frustration of users who were placed in queue while I worked on manually investigating and reinstating their account. I decided I needed a little help…
The first step is start out in the Event Viewer and find an event that you would like to be notified about. For this example set, I will replicate the the User Lockout Event I mentioned above: