<div>
Yes Thx 
i just figure it out
</div>

<div>
<div class="content wysiwyg-content">
Hi 
Some users always lock out in active directory 
When i looking for the security logs 
i getting this message: 
 
Unable to log events to security log: 
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Status code: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0xc0000008 
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Value of CrashOnAuditFail: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0 
&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Number of failed audits: &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;56 
 
 
Event xmlns=&quot;<a href="http://schemas.microsoft.com/win/2004/08/events/event" rel="ugc nofollow">http://schemas.microsoft.com/win/2004/08/events/event</a>&quot;&gt; 
- &lt;System&gt; 
&nbsp; &lt;Provider Name=&quot;Security&quot; /&gt; 
&nbsp; &lt;EventID Qualifiers=&quot;0&quot;&gt;521&lt;/EventID&gt; 
&nbsp; &lt;Level&gt;0&lt;/Level&gt; 
&nbsp; &lt;Task&gt;1&lt;/Task&gt; 
&nbsp; &lt;Keywords&gt;0xa0000000000000&lt;/Keywords&gt; 
&nbsp; &lt;TimeCreated SystemTime=&quot;2011-10-04T15:16:24.000000000Z&quot; /&gt; 
&nbsp; &lt;EventRecordID&gt;1157242617&lt;/EventRecordID&gt; 
&nbsp; &lt;Channel&gt;Security&lt;/Channel&gt; 
&nbsp; &lt;Computer&gt;dc01&lt;/Computer&gt; 
&nbsp; &lt;Security UserID=&quot;S-1-5-18&quot; /&gt; 
&nbsp; &lt;/System&gt; 
- &lt;EventData&gt; 
&nbsp; &lt;Data&gt;0xc0000008&lt;/Data&gt; 
&nbsp; &lt;Data&gt;0&lt;/Data&gt; 
&nbsp; &lt;Data&gt;56&lt;/Data&gt; 
&nbsp; &lt;/EventData&gt; 
&nbsp; &lt;/Event&gt; 
 
i cant figure it out what cuse the locking of those users. 
 
Advice
</div>
</div>

Hi
Some users always lock out in active directory
When i looking for the security logs
i getting this message:

Unable to log events to security log:
 	Status code:		0xc0000008
 	Value of CrashOnAuditFail:	0
 	Number of failed audits:	56


Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
 <Provider Name="Security" /> 
 <EventID Qualifiers="0">521</EventID> 
 <Level>0</Level> 
 <Task>1</Task> 
 <Keywords>0xa0000000000000</Keywords> 
 <TimeCreated SystemTime="2011-10-04T15:16:24.000000000Z" /> 
 <EventRecordID>1157242617</EventRecordID> 
 <Channel>Security</Channel> 
 <Computer>dc01</Computer> 
 <Security UserID="S-1-5-18" /> 
 </System>
- <EventData>
 <Data>0xc0000008</Data> 
 <Data>0</Data> 
 <Data>56</Data> 
 </EventData>
 </Event>

i cant figure it out what cuse the locking of those users.

Advice

event id 521 Unable to log events to security

Windows Server 2008 and Windows Server 2008 R2, based on the Microsoft Vista codebase, is the last 32-bit server operating system released by Microsoft. It has a number of versions, including including Foundation, Standard, Enterprise, Datacenter, Web, HPC Server, Itanium and Storage; new features included server core installation and Hyper-V.