AccountLockouts.xml

<?xml version="1.0" encoding="UTF-8"?>
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
	<SubscriptionId>AccountLockouts</SubscriptionId>
	<SubscriptionType>SourceInitiated</SubscriptionType>
	<Description>AccountLockouts</Description>
	<Enabled>true</Enabled>
	<Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
	<ConfigurationMode>Custom</ConfigurationMode>
	<Delivery Mode="Push">
		<Batching>
			<MaxLatencyTime>1000</MaxLatencyTime>
		</Batching>
		<PushSettings>
			<Heartbeat Interval="60000"/>
		</PushSettings>
	</Delivery>
	<Query>
		<![CDATA[
<QueryList><Query Id="0"><Select Path="Security">*[System[(EventID=4740)]]</Select></Query></QueryList>
		]]>
	</Query>
	<ReadExistingEvents>true</ReadExistingEvents>
	<TransportName>HTTP</TransportName>
	<ContentFormat>RenderedText</ContentFormat>
	<Locale Language="en-US"/>
	<LogFile>ForwardedEvents</LogFile>
	<PublisherName>Microsoft-Windows-EventCollector</PublisherName>
	<AllowedSourceNonDomainComputers><AllowedIssuerCAList></AllowedIssuerCAList></AllowedSourceNonDomainComputers>
	<!-- if you have multiple domains, you will need to get the identifiers of all the domains connecting to your Event Collector and put them below.  the easiest way is just to make a new subscription from the GUI and export it, then cut and paste that field in. 
	The SDDL below is just the well known identifiers for "Domain Users" and "Domain Computers" -->                
		<AllowedSourceDomainComputers>O:NSG:BAD:P(A;;GA;;;DC)(A;;GA;;;DD)S:</AllowedSourceDomainComputers>
</Subscription>