Security: TCP/IP address for connections

Security events in Event Viewer displays information about what workstation is attempting to log in, as well as what domain they are attempting to log in from.

That is all well and good if the information is valid.

I am seeing failed login attempts from invalid domains and workstations. But I would like to get the IP address of these systems without resorting to peering through a protocol analysis.