Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff 
Event ID: 529
Date:  1/5/2009
Time:  2:14:19 PM
User:  NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: altiris
  Domain:  domain
  Logon Type: 3
  Logon Process: NtLmSsp 
  Authentication Package: NTLM
  Workstation Name: MINWINPC
  Caller User Name: -
  Caller Domain: -
  Caller Logon ID: -
  Caller Process ID: -
  Transited Services: -
  Source Network Address: 1.2.3.4
  Source Port: 0
 
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.