JSI Tip 2091. More on automating the detection of logon failures.

Starting with Service Pack 4, Windows NT 4.0, and Windows 2000, also uses Event ID 644, on the PDC, and validating domain controller, to indicate a lockout.

Add it to your batch file.