If you can set up auditing and figure out exactly which event id and source
is recorded in the event logs when someone is locked out, then I think you
can use the health monitor to notify you in real time of the account lockout
events being recorded.