You will see failed login attempts for an account that doesn't exist anyways.

I would expect to see an event ID 529 or 681 with the following error code:

3221225572 C0000064 User logon with misspelled or bad user account


So if there is no guest account on the system, and somebody is trying to login as guest, that will generate an error that you can correlate to somebody trying to bruteforce. If you see enough of the events.


Description of security log event IDs----

http://support.microsoft.com/default...roduct=win2000

http://support.microsoft.com/default...b;EN-US;301677

681 error codes-
http://support.microsoft.com/default...roduct=win2000