How do you get detailed information on Active Directory logon failures?

Question

In my domain controller event log, I'm getting an account failure from a username of a service account.
The info is:

Security ID: DOMAIN\serviceaccount
Account Name: serviceaccount
Additional Information: 

Caller Computer Name: FreeRDP

This is really no help to me at all. I'm looking for an IP address, since any client can just 'tell' me who they are when they try to login. Is there any verbose or text based logging that I can check or implement to get source/destination IP, etc?

Answer 1

The security event log does not provide every conceivable piece of information. If you need more details, install and use SysMon:

https://technet.microsoft.com/en-us/sysinternals/sysmon

Network logging is not enabled by default, you would need to include the -n switch.

sysmon -accepteula –i –h sha1,sha256 –n