I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1.
I am able to find Audit Failure events (ID 4771) for incorrect username/password, but not when the account is locked out after too many incorrect attempts. So far I've discovered from reading online that the "Audit Account Lockout" group policy (Found at Computer Config > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff) must be set to Failure so that it logs the failures, but it still isn't being logged.
I have configured this policy under the Default Domain Policy and Default Domain Controllers Policy since there are a lot of account/password policies enabled here by default, normally I don't touch these GPOs.
After testing, I can see event ID 4625 is logged on the client's local event logs, but not on the DC. Again, I can see the incorrect username/password event 4771 on the DCs (I've checked all the DC logs too), just not 4625.
Note: When I configured the Audit Account Lockout event in Group Policy I configured it through the RSAT tools on my workstation. When I try to configure it locally on the DC, that specific setting is not available. My workstation is Windows 8.1 and Server is 2008 R1. I'm not sure if that makes a difference, but I've used my workstation to configure group policies before that I can't configure on the DC and they have worked.