I have purposefully typoed a password to see if the event log consolidator logged that ID. Win2k8R@ I cannot find it anywhere. I do see the failed logon with my Win2K3 server.
Can anyone tell me the reason why, and how can I have that id appear and alert? I have tried custom filters by event id, with no luck