You can schedule an daily network logon tracking report in the web reports which includes all authentications to domain controllers by users. This report is available under Reports Builtin Compliance Domain Account Authentication. To schedule this report you must add a JOB which can be found under Reports ...

KB-ID 404
Category: Web Reports

The easiest way to get notified in realtime whenever a user attempts to log on more than X times with a wrong password is by forwarding MicrosoftWindowsSecurityAuditing event 4625https://system32.eventsentry.com/security/event/4625. This event is logged to the Security event log whenever a user fails to logon. More...

KB-ID 407
Category: Compliance