To add to what Garreth said, if you want it to be 100 logon failures from the SAME user (not 100 logon failures from anyone), you want to use an Advanced Threshold (hit the little gear button as he pointed out) and specify SAME DestinationAccount. Otherwise, it's commonly the timeframe that makes these things work or not work.
↧