I'm trying to find which account was unsuccessfully signed in or unlocked (from a signed in Windows account where the screen was just locked).
I tried event viewer Security event 4625, but it doesn't show which user was unsuccessfully signed in/unlocked.
Is there any way to know which user was unsuccessfully signed in?
Not that I know of
You may find this helpful - not to the extent of it IDing the user name but you can see the meaning of 6D and 380
6D =The cause is either a bad username or authentication information
380 Sub Code - incorrect PIN
Logon Type 2 on your screenshot means - user has typed wrong password - but for password take it as meaning password in the widest sense.
Three in one hour seems to me to possibly suggest something a little more than a genuine user trying to log in and getting something wrong
What you do not tell us unless I have missed something is the type of computer setup - how many users etc - networked
this is
Another thought that crossed my mind have you tried noting times and date and comparing with 4624 - successful log ins
Quote