how would you log failed windows logins etc?

["Horta, Benny" <BHorta1 () dadeschools net>]

I am surprised no one has added to the default signatures failed login
attempts to a windows server how would such a signature be written and how
would someone log any administrator accout logins (ie user administrator)?

this would be useful to see account churners trying to bruteforce.