Sometimes an account is locked out but there isn't a corresponding Lockout event. (4255448)

Consider the following situation...

1. A user types their password wrong multiple times, enough to be locked out.
2. A Lockout event is generated via Change Auditor.
3. After a set amount of time, the user's account is automatically unlocked by Active Directory.
4. The user continues to type the wrong password, and locks them self out again.
5. No Lockout event is generated via Change Auditor.

This is expected behaviour.  In the above situation, the user's "lockoutTime" attribute is not reset to a value of 0.  Change Auditor is designed to only produce an event when the value changes to 0 (user account unlocked) or from 0 (user account locked).

The two ways to have this value change to 0 after being locked out is to either have an administrator unlock the account via Active Directory Users and Computers, or by the user successfully logging in with the proper credentials after the automatic unlock period.

To be alerted each time a lockout occurs you can audit when changes occur to the lockoutTime attribute:

1. Open the CA client
2. Click View | Administration
3. On the bottom left click Auditing
4. On the top left, in the tree view, click Attributes under Active Directory
5. Select User
6. In the bottom-left pane under Unmonitored Attribute type lockouttime
7. Select it and click Add
8. Select the Searches tab
9. Create a new search
10. Select the What tab
11. Click Add
12. Under Event Class type lockout
13. Select user lockoutTime changed and click Add | Add This Event
14. Click OK
15. Enable Alerting for the Search and save it