Windows Event ID 4625: An account failed to log on
- Applicable version
- Windows Vista and Windows Server 2008 and later
- Last reviewed
- 2026-10-01
Quick summary
Windows Security Event ID 4625 records an unsuccessful logon attempt and is a core source for investigating brute-force activity, password spraying, and account lockout reports.
Technical Metadata
| Event ID | 4625 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Failure |
| MITRE ATT&CK | TA0006 Credential Access / T1110.001 Password Guessing; TA0006 Credential Access / T1110.003 Password Spraying |
| Key fields to watch | Account For Which Logon Failed, Failure Reason / Status / Sub Status, Logon Type, Source Network Address / Source Port |
Trigger Scenarios
The event is generated when Windows authentication fails for an interactive, network, remote desktop, service, or other logon attempt. The Logon Type field identifies the authentication context.
Key Fields
Account For Which Logon Failed
The account name supplied to the authentication attempt. When the account does not exist, this may be attacker-controlled input rather than a valid directory account.
Failure Reason / Status / Sub Status
Read Status and SubStatus together: 0xC000006D is a general logon failure; 0xC000006A means a wrong password, 0xC0000064 a nonexistent account, 0xC0000234 a locked account, and 0xC0000072 a disabled account. A code may appear in Status rather than SubStatus; do not assume every failure uses the same pairing.
Logon Type
The logon method. Type 2 is console, Type 3 is network access such as SMB, and Type 10 is RemoteInteractive (RDP). Type 10 deserves focused review during remote-access investigations.
Source Network Address / Source Port
The client address and port observed by the target host. These fields are essential for grouping attempts, identifying attack infrastructure, and distinguishing local from remote failures.
Threat Hunting Queries
SecurityEvent
| where EventID == 4625 and SubStatus == "0xC000006A"
| summarize FailedAccounts=dcount(TargetAccount), Attempts=count() by IpAddress, bin(TimeGenerated, 5m)
| where Attempts > 10 and FailedAccounts > 3- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The 10-attempt and 3-account values are starting thresholds that must be tuned to the environment. The connector maps the Windows XML fields to SubStatus, TargetAccount, and IpAddress.
index=wineventlog source="WinEventLog:Security" EventCode=4625 SubStatus=0xC000006A
| bin _time span=5m
| stats dc(TargetUserName) as failed_accounts count as attempts by _time, IpAddress
| where attempts > 10 AND failed_accounts > 3- Data source
- Splunk Windows Security event data
- Assumptions
- Field aliases vary by Splunk add-on; map TargetUserName, IpAddress, and SubStatus to the local data model. The thresholds are tuning examples, not Microsoft defaults.
dataset = microsoft_windows_raw
| filter edr_event_id = 4625- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Windows Security logs are ingested through a Cortex XDR Windows event collection path. Inspect the raw Status, SubStatus, LogonType, and IpAddress values because parsed raw-field names can vary by collection path.
title: Windows Failed Logon With Bad Password
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
SubStatus: '0xC000006A'
condition: selection
falsepositives:
- Mistyped passwords and stale service credentials
level: medium
tags:
- attack.credential-access
- attack.t1110.001- Data source
- Sigma Windows Security log source
- Assumptions
- This single-event rule identifies candidates; password guessing and spraying require aggregation in the target SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| Status / SubStatus | 0xC000006D | STATUS_LOGON_FAILURE: invalid username or authentication information. | This general failure does not identify the precise cause; inspect SubStatus before classifying password guessing or nonexistent accounts. Source |
| Status / SubStatus | 0xC0000234 | STATUS_ACCOUNT_LOCKED_OUT: the account is locked out. | Correlate preceding wrong-password failures with Event ID 4740 and the effective lockout policy; this is not the disabled-account code. Source |
| Status / SubStatus | 0xC0000072 | STATUS_ACCOUNT_DISABLED: the referenced account is disabled. | Check whether a decommissioned service retains credentials before attributing attempts against a disabled account to an attacker. Source |
| SubStatus | 0xC000006A | The account name is valid, but the supplied password is wrong. | Repeated occurrences against one account support password-guessing triage; the same source across many accounts supports password-spray triage. Source |
| SubStatus | 0xC0000064 | The supplied account name does not exist. | A sequence of nonexistent names can indicate username enumeration rather than guessing against known accounts. Source |
| LogonType | 3 | Network logon, commonly generated by access to resources such as SMB shares. | Use it to separate network authentication failures from interactive and remote-interactive attempts. Source |
| LogonType | 10 | RemoteInteractive logon, typically Remote Desktop or Terminal Services. | It isolates failed remote desktop authentication for RDP-focused investigations. Source |
MITRE ATT&CK Mapping
- T1110.001Password Guessing
- T1110.003Password Spraying
Detection Notes
For T1110.001 Password Guessing, repeated SubStatus 0xC000006A failures against one account support a wrong-password hypothesis, but stale credentials produce the same code. For T1110.003 Password Spraying, investigate the same source failing against many accounts; event counts cannot establish that one password was reused. A threshold of more than 10 failures in a 5-minute window is a locally tuned example, not a Microsoft default. Type 3 means network access, not exclusively SMB; Type 10 is RemoteInteractive. Separate 0xC0000064 nonexistent accounts, 0xC0000234 lockouts, and 0xC0000072 disabled accounts, then correlate 4740 and any subsequent 4624 success by account, host, source, and time.
Common False Positives
- Users can generate a small number of failures while entering an old or mistyped password.
- A service account with an outdated stored credential can create periodic, highly regular failures after a password rotation.
- Mapped drives, scheduled tasks, and applications may retry cached credentials automatically after a password change.
Related Events
Sample Log
Account For Which Logon Failed: CORP\jsmith
Failure Reason: Unknown user name or bad password
Status: 0xC000006D
Sub Status: 0xC000006A
Logon Type: 3
Source Network Address: 10.x.x.x
Source Port: 51422Frequently Asked Questions
What does Windows Event ID 4625 mean?
Event ID 4625 records a failed Windows logon attempt on the computer where access was attempted. Status, SubStatus, LogonType, and source network fields explain the failure context.
Does one Event ID 4625 prove a brute-force attack?
No. A single failure is commonly caused by a mistyped or stale password; detection requires correlation by account, source, failure code, logon type, time window, and any subsequent successful logon.
What is the difference between 4625 Status 0xC000006D and SubStatus 0xC000006A or 0xC0000064?
0xC000006D is a general logon failure. SubStatus 0xC000006A narrows it to a wrong password; 0xC0000064 means the account does not exist. Read both fields rather than classifying all 0xC000006D failures as password guessing.
Does Event ID 4625 Logon Type 3 mean an RDP attack?
No. Type 3 is a network logon, including SMB access; Type 10 is RemoteInteractive, typically RDP. Neither identifies an attack by itself. Compare the source address, account, failure codes, and service context; stale mapped-drive credentials can also generate Type 3 failures.
Sources
- MS-ERREF: NTSTATUS Values
Microsoft · vendor
- 4625(F): An account failed to log on
Microsoft · vendor
- Brute Force: Password Guessing (T1110.001)
MITRE ATT&CK · attack
- Brute Force: Password Spraying (T1110.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule