NT Security Log

Tracing who this is

[Tracetech]

IS there any software or way of tracing the info from the NT security log to see who keeps trying to get into a server
I get the failed audit with info on machine name, but no IP address records here. I would like to be able to tell who it is that continuously tries to get it.

Logon Failure:
Reason:Unknown user name or bad password
User Name:Administrator
Domain:WEBSERVER
Logon Type:3
Logon Process:KSecDD
Authentication Package:MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name:\\WEBSERVER

Any info would be appreciated

[bcolflesh]

Welcome to WW - I believe the security.log file is for everything from HKEY_LOCAL_MACHINE\Security - so that is probably a manual attempt - someone trying to login as Admin at the comp itself - put a webcam in that room.

Regards,
Brent