This is the e-mail I have setup. But it is for all users and not for a certen account:%Device.Address=192.168.1.1
%PassiveMonitor.DisplayName=Account Locked Out
%PassiveMonitor.Payload.ComputerName=DC01
%PassiveMonitor.Payload.User=NT AUTHORITY\SYSTEM
%PassiveMonitor.Payload.Logfile=Security
%PassiveMonitor.Payload.Type=Audit Success
%PassiveMonitor.Payload.EventType=4
%PassiveMonitor.Payload.SourceName=Security
%PassiveMonitor.Payload.Category=7
%PassiveMonitor.Payload.CategoryString=Account Management
%PassiveMonitor.Payload.EventCode=644
%PassiveMonitor.Payload.EventID=644
%PassiveMonitor.Payload.TimeGenerated=20081222134622.000000-360
%PassiveMonitor.Payload.TimeWritten=20081222134622.000000-360
%PassiveMonitor.Payload.Message=User Account Locked Out:
Target Account Name: john
Target Account ID: domain/john
Caller Machine Name:
Caller User Name: DC01$
Caller Domain: domain
Caller Logon ID: (0x0,0x3E7)
%PassiveMonitor.Payload.LogicalSource=192.168.1.1
%PassiveMonitor.Payload.PhysicalSource= 192.16.1.1
%PassiveMonitor.Payload.EventType=Windows Event Log