How to find process, service or device that is using wrong credentials

Hello, according to this EventLog, I am searching for a way, how to find process, service or device that is using wrong credentials.

Failure Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      529
Date:            02/11/2009
Time:            15:49:31
User:            NT AUTHORITY\SYSTEM
Computer:      ITMLARTPRD192
Description:
Logon Failure:
       Reason:            Unknown user name or bad password
       User Name:      USer2004
       Domain:            XXXX192
       Logon Type:      2
       Logon Process:      Advapi  
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      XXXX192

I have search for all connections, mapped drives, scheduled tasks and nothing.

That is way I am asking you, EXPERTS, if there is a way how to find, what is using wrong credentials.