How to read Windows Event ID 4625: failed logons, status codes, and logon types

What 4625 records

Event ID 4625 in the Security log means “An account failed to log on.” It is written by the machine that evaluated the logon: the workstation for local accounts, the server being accessed for network logons, and domain controllers for some Kerberos and NTLM failures. The audit subcategory Logon must have Failure auditing enabled.

The fields that matter are Account For Which Logon Failed (the user), Failure Information (status and sub-status), Logon Type, and Network Information (workstation name and source network address).

Status and sub-status codes

Status 0xC000006D is a generic “bad user name or password”. The sub-status narrows it down. 0xC0000064 means the user name does not exist. 0xC000006A means the name is valid but the password is wrong. 0xC0000234 means the account is locked out. 0xC0000072 means disabled, 0xC000006F means outside allowed hours, 0xC0000071 means the password expired, and 0xC0000193 means the account expired.

The difference between 0xC0000064 and 0xC000006A is the most useful. Many failures for non-existent names suggest someone trying a list. Many 0xC000006A failures for one real user suggest guessing that user, or an old password saved in a service, a mapped drive, or a phone.

• 0xC0000064: user does not exist
• 0xC000006A: wrong password for a real user
• 0xC0000234: account locked out
• 0xC0000072: account disabled
• 0xC0000071: password expired

Lab: generate and query failures

On a Windows lab VM, fail an interactive logon twice with a wrong password, then fail a network logon by mapping a share with net use and a wrong password from another VM. Query the Security log with Get-WinEvent and a FilterHashtable, extracting the target user, logon type, sub-status, and source address from the event XML.

You should see Logon Type 2 for the console failures and Logon Type 3 for the share attempt, with the other VM’s address in IpAddress.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)} |
  ForEach-Object {
    $x = [xml]$_.ToXml(); $d = @{}
    $x.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]@{ Time=$_.TimeCreated; User=$d.TargetUserName; Type=$d.LogonType;
      SubStatus=$d.SubStatus; Source=$d.IpAddress; Workstation=$d.WorkstationName }
  } | Format-Table -AutoSize

Triage patterns

Many users, few failures each, from one address is password spraying. One user, many failures, from one internal workstation with Logon Type 3 is often a stale credential in a service or scheduled task on that workstation. Failures with Logon Type 10 from an internet address mean RDP is exposed.

Pair 4625 with 4624 successes from the same source. Failures followed by a success is the pattern that turns noise into an incident.