Hi,
thanks for taking time to reply! for some reason that doesnt appear on my lem report for user authentication failed logon, although i do have all logon and logoff events on the Domain controller policy for auditing and on the PC i am testing with.
there are other events logging from this domain back to the LM such as user admin logons etc, so will re-check all the GPO's for logon/logoff events and report back.