Thanks Manie.

You can use the default trace to check for login failures, here's an idea on how:

SELECT

I.*

FROM

sys.traces T CROSS Apply

:: fn_trace_gettable(CASE WHEN CHARINDEX('_', T.[path]) <> 0

THEN SUBSTRING(T.PATH, 1,

CHARINDEX('_', T.[path]) - 1) +

'.trc'

ELSE T.[path]

End, T.max_files) I JOIN

sys.trace_events AS TE ON

I.EventClass = TE.trace_event_id

WHERE

TE.[name] = 'Audit Login Failed'

At R. Barry Young's suggestion I am working on a presentation about mining the default trace that will likely turn into at least one article here at SSC within a year or so. Your question helps with ideas. It takes me awhile to write and I have a series on Profiler that I need to finish first.