Monitor Windows Logon Failures

For failed Windows authentication attempts, your best bet is probably the IIS logs.

So the best way to get notification of someone typing in their password incorrectly into their desktops would be IIS logs?

Oops - I've been thinking too much about Orion website logins. I didn't realize you meant just general windows login failure. This has nothing to do with IIS then.

In that case, I would recommend our Windows Event Forwarder. You should be able to get it from the additional components section on your customer portal. If you run that on the domain controllers, you should be able to pick up the audit failure events and send them off to Orion as syslog messages. From their you can archive them, search them, and generate alerts.

Thank you for your assistance.