I am trying to see the Log On failures in Audit Trail. I have turned on Session Failure for the Everyone group in the Admin Console, logged a few failures by attempting to login with an invalid password, waited 24 hours, checked the log and nothing is showing up in the logs. Nothing is logged with the value Succeeded? False
What action writes a Succeeded? False event to the session log? Is a 9010 event (invalid username or password) not a sufficient login failure?