Event ID 4625Audit FailureSecurityT1110

Windows Event ID 4625 — Failed Logon

Event ID 4625 records a failed logon on the computer handling the attempt. Start with Status and SubStatus, the account, source and Logon Type. A bad password or unknown account can result from ordinary mistakes, stale credentials or malicious attempts; the code alone does not establish an attack.

MITRE ATT&CK

Technique

T1110 · Brute Force

Tactic

Credential Access

View on attack.mitre.org →

Why It Matters

The same failure can have very different causes. A service retrying an old password, a user making a typo and automated password guessing may all produce failed logons. Group related events by account, source and time, check your baseline, and inspect successful logons or lockouts where relevant. For domain authentication, also review the appropriate domain-controller events, including Kerberos pre-authentication failures (4771).

Key Fields

Sub Status CodeThe precise failure reason. 0xC000006A = bad password; 0xC0000064 = unknown or misspelled account; 0xC000006D = generic logon failure; 0xC0000234 = account locked out; 0xC0000072 = account disabled; 0xC000006F = logon outside allowed hours; 0xC0000071 = password expired; 0xC0000193 = account expired
Account NameThe targeted account — Administrator, service account names, and Domain Admin members are the highest-value targets
Source Network AddressThe IP the authentication attempt originated from — a useful pivot for checking where the request originated; availability varies by context
Logon Type3 = Network; 2 = Interactive; 5 = Service; 10 = RemoteInteractive. Interpret the logon context rather than treating the type as proof of an attack.
Workstation NameHostname of the source — compare with Source Network Address; a mismatch needs checking against name resolution and authentication context
Authentication PackageThe package used for authentication; interpret it alongside domain-controller events rather than inferring intent from the package alone

Investigation Tips

  1. 1.Read Status and SubStatus together: 0xC000006D is a general logon failure; 0xC000006A indicates a bad password and 0xC0000064 an unknown or misspelled account. These describe the failure, not the intent.
  2. 2.Group failures by account, source and time. Many attempts against one account can warrant a brute-force investigation; failures spread across accounts can warrant a password-spray investigation. Validate any thresholds against normal activity.
  3. 3.Check ordinary causes first: saved credentials, scheduled tasks, services, mapped drives and devices retaining an old password can repeatedly retry without malicious activity.
  4. 4.Inspect Logon Type and authentication context. Network logons, services and remote interactive sessions have different expected patterns. Failed RDP authentication can also appear as network logons depending on the authentication stage.
  5. 5.Correlate lockouts with Event 4740 and its Caller Computer Name. A lockout establishes that the account was locked, not that the cause was an attacker.
  6. 6.Look for Event 4624 after failures using the same account and source. A subsequent success needs investigation; a user correcting a password can produce that sequence too.
  7. 7.Check related domain-controller authentication events, including 4771 and 4776, when the local event does not explain the failure. Missing fields or low event volume do not prove that no activity occurred.

Detection Logic

Illustrative Microsoft Sentinel KQL for grouping failures. Validate field names and thresholds against your connector schema and baseline; these queries do not establish malicious intent.

// Brute force: 20+ failures against one account from one source within 5 minutes
SecurityEvent
| where EventID == 4625
| summarize FailCount=count() by TargetAccount, IpAddress, bin(TimeGenerated, 5m)
| where FailCount >= 20
| sort by TimeGenerated desc

// Password spray: one IP targeting 5+ distinct accounts within 30 minutes
SecurityEvent
| where EventID == 4625
| summarize Accounts=dcount(TargetAccount), IPs=make_set(IpAddress)
    by IpAddress, bin(TimeGenerated, 30m)
| where Accounts >= 5
| extend Alert = "Password spray — one source targeting multiple accounts"
| sort by TimeGenerated desc

Frequently Asked Questions

What does SubStatus 0xC000006A mean in Event 4625?
It indicates a bad password. A user typo, saved credential or service using an old password can produce it, as can password guessing. Check who or what made the attempt and whether its rate and distribution are unusual.
How is 0xC0000064 different from 0xC000006A?
0xC0000064 indicates an unknown or misspelled account; 0xC000006A indicates a bad password. Repeated unknown-account failures can warrant an enumeration investigation, but typing errors and outdated configuration must also be considered.
Does a successful logon after Event 4625 prove compromise?
No. A user correcting a password can create failures followed by a success. Investigate the same account and source, the time interval, expected access and subsequent activity before drawing a conclusion.
How do I find the source of an account lockout?
Inspect Source Network Address and Workstation Name where present, then correlate with Event 4740 and Caller Computer Name. Check services, scheduled tasks and saved credentials on the relevant device. Not every authentication context populates every field.

Go deeper: the full Event ID 4625 — Failed Logon guide

Explore the related technique, investigation steps, and evidence to consider alongside this event.

Read the Event ID 4625 — Failed Logon guide →

See Event ID 4625 in your logs

Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.

Decode an event →
← All detection guides·Decode an event →