Audit User Account

The security log won't tell you when an account is disabled, but if you audit invalid or failed login attempts you will see users who attempt to log in over and over unsuccessfully and lock themselves out of the system.

So, if your account lockout policy is set to, say, 10 attempts, you can look at your security log and look for long strings of users failing to log on. If you see 10 or more, you'll know they've locked themselves out.

Take care,
Mike Oliveri

Open User Manager for Domains. Click Policies -> Audit. Click the checkbox for Logon and Logoff Failure. Click Ok.
Now, when a user logs in incorrectly, the Security log of your PDC will record Event ID 529, which is the bad username/password event.
Then, based off your Account Lockout setting (say 3 invalid logon attempts and the account is locked out), Event ID 644 will be recorded in the Security log.
It is this event id that you are looking for. This is the Account Locked Out event. So,do these steps, then check your logs for 644.

hope this helps