Windows keeps a doorman's diary: every wrong password lands in the Security log as event ID 4625 — and almost nobody opens it.
One command reads it: Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}. My count over 30 days: 0. Quiet is normal — the danger is a curve: odd hours, accounts you don't recognize, the same source repeating. One event is noise; a pattern is a knock.
