Active Directory failed logon auditing.

I need to see failed logon attempts and account lockouts in the event log. This was somehow recently disabled. To enable, edit the Default Domain Controllers Policy, NOT the Default Domain Policy.

Computer Configuration / Policies / Windows Settings / Security Settings / Audit Policy

Policy	Setting
Audit account logon events	Failure
Audit account management	Success
Audit logon events	Failure

If you are troubleshooting account lockouts, use EventCombMT!