Enable logging

By default domain controllers only log successful login attempts, therefore you should first off all start logging failed login attempts. This is done via Group Policy:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy

Enable both Success and Failure event logging for following Policies:

• Audit account logon events
• Audit account management
• Audit logon events

In theory it should be enough to apply above Group Policy settings only to your Domain Controllers, but it may be beneficial to have it applied to other computers as well. For example, if client is logging form a workstation to a terminal server, domain controller will log login attempts coming from the terminal server. But if you have “Audit logon events” enabled on terminal server itself, you will be able to see which workstation user is trying to login from.

Useful Event IDs (Server 2003 / Windows XP)

Domain Controllers

Event ID: 675
Category: Account Logon
Type: Failure Audit
Description: Pre-authentication failed

Event ID: 644
Category: Account Management
Type: Success Audit
Description: User Account Locked Out

Event ID: 540
Category: Logon/Logoff
Type: Success Audit
Description: Successful Network Logon

Event ID: 538
Category: Logon/Logoff
Type: Success Audit
Description: User Logoff

Servers and Clients

Event ID: 529
Category: Logon/Logoff
Type: Failure Audit
Description: Logon Failure. Unknown user name or bad password

Event ID: 539
Category: Logon/Logoff
Type: Failure Audit
Description: Logon Failure. Account locked out

Event ID: 528
Category: Logon/Logoff
Type: Success Audit
Description: Successful Logon

Event ID: 551
Category: Logon/Logoff
Type: Success Audit
Description: User initiated logoff

Lockout Status

Another potentially useful tool is Microsoft Account Lockout Status (LockoutStatus.exe). This utility displays lockout status for particular user account. Information is collected from every domain controller in your domain.
Tool can downloaded from here or directly from Microsoft.