Audit account logon events are currently set for Success and Failure, unfortunately, the failed login logs are no where to be found and not working ( EventID 4625 ).

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625

Already tried this, but it is not working:

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/NPS-2008-user-auth-and-fails-not-showing-in-eventviewer/m-p/18120#M1017

OS is Windows Server 2008 R2 Enterprise and joined to a domain.

Did you try the feature : advanced auditing gpo settings? and who all are your targeted computers in terms of OS?