Account lockout-related event logs

Event ID
Description
528
A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below.
529
Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.
530
Logon failure. A logon attempt was made, but the user account tried to log on outside of the allowed time.

I am now Windows 2008 certified!

Passed 70-649 two weeks ago, which gave me three certificates:

MCTS: Active Directory
MCTS: Network
MCTS: Application Infrastructure

Two more exams to get my MCITP: Enterprise Admin

Update (Jun 12): Passed 70-747. One more exam (70-680) to get my MCITP:Enterprise Admin
Update (Sep 23): Passed 70-680. Now I am MCITP: Enterprise Admin!

Suggested Thresholds for Essential Counters

This is excerpted from an MS article for w2k resource kit. Most of the numbers should still be applicable to newer version of OSes.

Resource
Object/Counter
Threshold
Comments

Disk
PhysicalDisk\% Disk Time
90%

Disk
PhysicalDisk\ Disk Reads/sec, PhysicalDisk\Disk
Depends on manufacturer's specifications
Check the disk's specified transfer rate to verify that the logged rate doesn't exceed specifications.(1)