Windows event log + subscription to “Account locked out” event
There is just my script for a subscription on event 4740:
@echo off
wevtutil qe Security “/q:*[System [(EventID=4740)]]” /f:text /rd:true /c:1 > c:\Event\event4740.txt
c:\Event\postie.exe -host:192.168.111.222 -port:25 -to:admin@local.com -from:event@local.com -s:”Account Locked Out on Server” -msg:Server -file:”c:\Event\event4740.txt”
Zoneminder IPSEC + FreeBSD tweaks