Event ID 531

Logon Failure:
    Reason:                 Account currently disabled
    User Name:              %1
    Domain:                 %2
    Logon Type:             %3
    Logon Process:          %4
    Authentication Package: %5
    Workstation Name:       %6
    Caller User Name:       %7
    Caller Domain:          %8
    Caller Logon ID:        %9
    Caller Process ID:      %10
    Transited Services:     %11
    Source Network Address: %12
    Source Port:            %13
    Caller Process Name:    %14