01D97C.xml

<ViewerConfig>
    <QueryConfig>
        <QueryParams>
            <UserQuery />
        </QueryParams>
        <QueryNode>
            <Name>Administrator Logon (Failed)</Name>
            <Description>Failed Administrator Account Logons</Description>
            <QueryList>
                <Query Id="0" Path="Security">
                    <Select Path="Security">
                        *[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4625)]] and
                        *[EventData[Data[@Name="TargetUserName"]="Administrator"]]
                    </Select>
                </Query>
            </QueryList>
        </QueryNode>
    </QueryConfig>
</ViewerConfig>