For some reason our domain controllers (2008 R2) are not logging failed logon attempts from users on workstations. The 4625 event ID will get logged on the workstation but not on the DC. Account lockouts will show up on the DC in the security log though.
We had recently created new domain controllers with the same name and IPs as the previous 2003 servers and demoted them as we replaced them so I don't know if something got messed up in the process.
I saw this thread and the things that made sense to me didn't apply but that doesn't mean the answer is not in there!
http://social.technet.microsoft.com/Forums/windowsserver/en-US/90f0b010-b6f2-4055-9dd7-98f0d35c57b7/failed-logon-attempts-to-domain-are-being-logged-on-local-workstations-but-not-on-domain-controllers?forum=winserverGP
Any ideas?
Free computer help and tips http://www.onlinecomputertips.com