i'm trying to figure out how to exclude the 'user account locket out' event from the real time alerts. If these events show up in the summary reports its ok, but we are a school we have lots of students who forget thier passwords and so on we get lots of of those real time alerts, and this is not very interesting info for us.
Real time alerts do not have exclusions but you can be more granular with what alerts you configure. I assume you have the global alert turned on for ALL changes made in active directory? If not, then you probably have the alert for account lockouts on which you could then just turn off of course.
There are no exclusions for real time alerts so i suggest setting up real time alerts for the things that are most important. Alternatively you could set up a mail rule to move lockout related alerts to their own folder.