(?i)lockouttime=(?P<LockOutTime>.+)
the lockouttime line could look like this:
lockoutTime=09:38.14 AM, Mon 01/28/2013
if it matters.
A lot of the log I had to cut out because of character limit.
msExchHideFromAddressLists=TRUE
manager=CN=******\, Dan,OU=Technical Support,OU=Corporate Office,OU=CGS Users,DC=******,DC=local
lastLogonTimestamp=12:20.04 PM, Mon 01/21/2013
dSCorePropagationData=\x3?\xE@?\x4&??V??~[?|$??YoX??y\x1C??O?\x1C| ??A\xF\x1F?\x3hS?4??U20121102172743.0Z|20121017184820.0Z|20121016140931.0Z|20121012204612.0Z|16010714223649.0Z
mSMQDigests=\x3?\xE@?\x4&??V??~[?|$??YoX??y\x1C??O?\x1C| ??A\xF\x1F?\x3hS?4??U
mSMQSignCertificates=\x3
lockoutTime=0
logonHours=<binary>
Post a sample event on here and i'm sure either one of us will come up with the proper regex for you. I believe this is a known limitation right now for the extract field tool.