1. Open the Change Auditor Client and select the “Search” tab
2. If search Properties has not been enabled, enable it by selecting Show Properties in the Button Bar menu.
3. Click "New" in the Button Bar menu to create a new search.
4. Select the Info tab and give the search a descriptive Search Name and a description if desired
5. Select the “What” tab in the search properties section at the bottom
6. Click the “Add” button and type “Lock” in the filter section of the Event Class column
7. Select “User Account Locked”
8. Click the “Add” button in the lower pane to move your selection to the parameter section
9. Click “Ok”
10. To enable an alert, select the Alert tab.
11. Choose how to send the alert. SNMP, WMI or SMTP
12. If the Coordinator has been configured to use the mail server select the Configure email.... button, entering the recipient details and the Reply to.. if desired.
13. Select the save button to save the search