Event ID: 539

Logon Failure : Account locked out

Logon Failure:
    Reason:                 An error occurred during logon
    User Name:              %1
    Domain:                 %2
    Logon Type:             %3
    Logon Process:          %4
    Authentication Package: %5
    Workstation Name:       %6
    Status code:            %7
    Substatus code:         %8
    Caller User Name:       %9
    Caller Domain:          %10
    Caller Logon ID:        %11
    Caller Process ID:      %12
    Transited Services:     %13
    Source Network Address: %14
    Source Port:            %15
    Caller Process Name:    %16


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:Logon/Logoff
How to enable Windows Auditing


Audit Category:
Logon/Logoff

LEFT/RIGHT arrow keys for navigation

Back to List