Logging local account lockouts with a script in Windows Server 2008

Question

I would like to know if it is possible to create a script to create a log every time a local account on a server gets locked out.

Answer 1

This is already logged in the Security log as Event ID 644. You don't need to reinvent the wheel, here.

If you would like to launch a script to do something else whenever an Event 644 (lockout) is logged, you can do this in Task Scheduler. You'll create a "Trigger" that watches for that event and calls your script whenever that happens.