it's a PITA but you have to check each login failure with event ID 18456 in the app log on the server. what sucks is that the view may return 10 failures when in reality it's just one login failure