Lockouts are not tracked

Some lockout events are not tracked, though audit and all settings for NetWrix Account Lockout Examiner have been configured correctly and connection to the required domain controller (DC) and audit setup are shown as OK, not recording lockouts
KB1385 | Last review: Aug 22, 2017 | Netwrix Account Lockout Examiner | 4.0 and above
Email It to Me Print this Page
First, make sure the Windows security log works well on your DC: connect via Event Viewer and check that events are logged.
If the events are written correctly, but NetWrix Account Lockout Examiner still does not track them, do the following:
  1. On the computer where NetWrix Account Lockout Examiner is installed, open Registry Editor: navigate to Start - Run, enter regedit and click OK.
  2. In the Registry Editor left pane, navigate to HKLM\Software\[Wow6432Node]\NetWrix\Account Lockout Examiner, (Wow6432Node only for x64 OS). 
  3. In the right pane, double-click readLog and set its value to 0.
  4. Create a new DWORD named UseWatcher and set its value to 1. 
  5. Restart the Netwrix Account Lockout Examiner service via the Services snap-in. 
User-added image

If the above doesn`t help, try to change the value of UseWMI registry key to 0

User-added image
Was this information helpful?