Logging ntlm authentication failures