This script will send you an notification when an user account is locked out.
I modified the output, normally it would look like this:
Security ID: S-1-5-18
Account Name: DC
Account Domain: DOMAIN
Logon ID: 0x3e7
Account That Was Locked Out:
Security ID: S-1-5-21-162996128-1511881221-1856903913-1149
Account Name: test
Caller Computer Name: \\VM
Let this script run with task scheduler on EventID 4740, you can do that like this
powershell -command "& 'C:\Powershell\account_locked_out.ps1' "
Please fill your own SMTP and email info etc.
Any questions of suggestions are welcome!