|I do not have XP Pro.|
In experimenting with what XPUser says,
I cleared all events in Event Viewer,
then did Windows key + L,
then did a bad password login.
I found out that password attempts are in the Security folder in E.V., and has an Event number of 529
For some reason two 529s came up, when I did that once.
Also, if you click on the word "Event" at the top of that column, then all Events get listed in numerical order.