Security

Default Domain Controller GPO snap-in.
Enabling Auditing on All DCs
You can modify the audit policy for DCs.

To enable auditing:

In the scope pane, select Audit Policy.
In the result pane, double-click Audit directory service access.
Select Audit Failed Attempts, and click OK. The settings should be updated in the result pane.
Close the console loaded with the Default Domain Controller GPO snap-in.
When prompted to save console settings, click No.