Filter Security event, look for these two event id:
4740 - for locked out.
4767 - for unlocked.

4776 - for Credential Validation, then use Find (ex: Source Workstation) to narrow down the search.