Elastic Windows Event Explorer
Channel - Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
Publishers
Microsoft-Windows-AuthenticationProvider
Microsoft-Windows-NTLM