First, auditing of logon failures needs to be enabled. As a matter of practice, I've always put it in an enforced default domain policy, but you should at least have it applied to your domain controllers. The entry is called Audit Account Logon Events, and it only defaults to logging Success for some reason. Info on this setting is available from Microsoft on Technet here.
Once that is enabled, the security logs of the Domain Controller processing the login should contain the necessary information. Specifically, check for Failure Audits of Logon/Logoff Events. The username should be a column called User that you can sort/filter by to ease the search.