You could use a server-side trace or an extended events session to capture the login failed events (profiler could also work if this is not a production instance). Have you tried that?