If you have multiple BDCs and/or trust relationships, the logon event may be in any %LogonServer%. Instead of checking all the Security event logs, use the DUMPEL.EXE from the

with a batch file to filter for logon failures:

    @echo off
    Dumpel.exe -s pdcname -l security -m security -e 529 539  >Drive:\Directory\failure.log.txt
    Dumpel.exe -s bdc1name -l security -m security -e 529 539 >>Drive:\Directory\failure.log
    Dumpel.exe -s bdc2name -l security -m security -e 529 539 >>Drive:\Directory\failure.log
    Dumpel.exe -s bdc3name -l security -m security -e 529 539 >>Drive:\Directory\failure.log

This will append all Event 529s and Event 539s to the <Drive:>\Directory\failure.log file which you can then examine for problems.

    Event ID 529
    Logon Failure
    Reason: Unknown user name or bad password

    Event ID 539
    Logon Failure
    Reason: Account locked out

Common causes for invalid logon events are:

Someone is entering the wrong password.
An unauthorized individual is trying to gain access
There is a persistent network connection with an invalid password.
There is a service using a user account with an invalid password.
A Trust relationship has been broken.