// events/4625 · Sign-in

Event ID 4625An account failed to log on

Logged on the target computer for any failed logon. The Status and Sub Status fields carry an NTSTATUS code that explains why it failed.

Log	`Security`
Source	`Microsoft-Windows-Security-Auditing`
Area	Sign-in

What to check

Read the Sub Status first, then check the Logon Type, Workstation Name and Source Network Address. Several 0xC0000064 events in a row can mean username enumeration; repeated 0xC000006A or 0xC000006D against service or admin accounts suggests password guessing.

Codes you'll see in this event

Code	Meaning
`0xC000005E`	No logon servers available to service the request. Usually an infrastructure or availability problem.
`0xC0000064`	Misspelled or non-existent user name.
`0xC000006A`	Correct user name, wrong password.
`0xC000006D`	Bad user name or authentication information.
`0xC000006F`	Logon outside the account's permitted hours.
`0xC0000070`	Logon from a workstation the account is not allowed to use.
`0xC0000072`	Account disabled by an administrator.
`0xC000015B`	User has not been granted the requested logon type (logon right) on this machine.
`0xC0000192`	Netlogon service was not started.
`0xC0000193`	Account has expired.
`0xC0000234`	Account is locked out. The doc notes this is the typical Status value for the event.
`0xC0000413`	Authentication firewall: the account is not allowed to authenticate to this machine.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines

1
2
3
4
5SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4625
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Sign-in events

Event ID 4624: An account was successfully logged on
Event ID 4634: An account was logged off
Event ID 4647: User initiated logoff
Event ID 4648: A logon was attempted using explicit credentials
Event ID 4672: Special privileges assigned to new logon
Event ID 4776: The computer attempted to validate the credentials for an account

Search all 123 event IDs →

Sources

Microsoft documentation for event 4625