SOC Event Lookup
Event ID 4625LogonP1

Windows Event ID 4625: An account failed to log on

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4625 records an unsuccessful logon attempt and is a core source for investigating brute-force activity, password spraying, and account lockout reports.

Technical Metadata

Technical metadata for Event ID 4625
Event ID4625
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Failure
MITRE ATT&CKTA0006 Credential Access / T1110.001 Password Guessing; TA0006 Credential Access / T1110.003 Password Spraying
Key fields to watchAccount For Which Logon Failed, Failure Reason / Status / Sub Status, Logon Type, Source Network Address / Source Port

Trigger Scenarios

The event is generated when Windows authentication fails for an interactive, network, remote desktop, service, or other logon attempt. The Logon Type field identifies the authentication context.

Key Fields

Account For Which Logon Failed

The account name supplied to the authentication attempt. When the account does not exist, this may be attacker-controlled input rather than a valid directory account.

Failure Reason / Status / Sub Status

These fields explain why authentication failed. Common sub-status values include 0xC000006A for a bad password, 0xC0000064 for an unknown user, 0xC0000234 for a locked account, and 0xC0000072 for a disabled account.

Logon Type

The logon method. Type 2 is console, Type 3 is network access such as SMB, and Type 10 is RemoteInteractive (RDP). Type 10 deserves focused review during remote-access investigations.

Source Network Address / Source Port

The client address and port observed by the target host. These fields are essential for grouping attempts, identifying attack infrastructure, and distinguishing local from remote failures.

Threat Hunting Queries

Microsoft Sentinel KQL: Repeated bad-password failures by source
SecurityEvent
| where EventID == 4625 and SubStatus == "0xC000006A"
| summarize FailedAccounts=dcount(TargetAccount), Attempts=count() by IpAddress, bin(TimeGenerated, 5m)
| where Attempts > 10 and FailedAccounts > 3
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The 10-attempt and 3-account values are starting thresholds that must be tuned to the environment. The connector maps the Windows XML fields to SubStatus, TargetAccount, and IpAddress.
Query reference
Splunk SPL: Repeated bad-password failures by source
index=wineventlog source="WinEventLog:Security" EventCode=4625 SubStatus=0xC000006A
| bin _time span=5m
| stats dc(TargetUserName) as failed_accounts count as attempts by _time, IpAddress
| where attempts > 10 AND failed_accounts > 3
Data source
Splunk Windows Security event data
Assumptions
Field aliases vary by Splunk add-on; map TargetUserName, IpAddress, and SubStatus to the local data model. The thresholds are tuning examples, not Microsoft defaults.
Cortex XQL: Retrieve failed-logon events
dataset = microsoft_windows_raw
| filter edr_event_id = 4625
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Windows Security logs are ingested through a Cortex XDR Windows event collection path. Inspect the raw Status, SubStatus, LogonType, and IpAddress values because parsed raw-field names can vary by collection path.
Query reference
Sigma rule: Windows failed logon with a valid account and bad password
title: Windows Failed Logon With Bad Password
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
        SubStatus: '0xC000006A'
    condition: selection
falsepositives:
    - Mistyped passwords and stale service credentials
level: medium
tags:
    - attack.credential-access
    - attack.t1110.001
Data source
Sigma Windows Security log source
Assumptions
This single-event rule identifies candidates; password guessing and spraying require aggregation in the target SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
SubStatus0xC000006AThe account name is valid, but the supplied password is wrong.Repeated occurrences against one account support password-guessing triage; the same source across many accounts supports password-spray triage. Source
SubStatus0xC0000064The supplied account name does not exist.A sequence of nonexistent names can indicate username enumeration rather than guessing against known accounts. Source
LogonType3Network logon, commonly generated by access to resources such as SMB shares.Use it to separate network authentication failures from interactive and remote-interactive attempts. Source
LogonType10RemoteInteractive logon, typically Remote Desktop or Terminal Services.It isolates failed remote desktop authentication for RDP-focused investigations. Source

MITRE ATT&CK Mapping

  • T1110.001Password Guessing
  • T1110.003Password Spraying

Detection Notes

T1110.001/T1110.003 detection should separate Sub Status 0xC000006A (valid account, bad password) from 0xC0000064 (unknown account). More than 10 failures in a 5-minute window from one Source Network Address against many accounts is a starting spray threshold, while Logon Type 10 isolates RDP and Type 3 isolates SMB. Correlate a following 4624 success.

Common False Positives

  • Users can generate a small number of failures while entering an old or mistyped password.
  • A service account with an outdated stored credential can create periodic, highly regular failures after a password rotation.
  • Mapped drives, scheduled tasks, and applications may retry cached credentials automatically after a password change.

Related Events

Sample Log

Sanitized event sample
Account For Which Logon Failed: CORP\jsmith
Failure Reason: Unknown user name or bad password
Status: 0xC000006D
Sub Status: 0xC000006A
Logon Type: 3
Source Network Address: 10.x.x.x
Source Port: 51422

Frequently Asked Questions

What does Windows Event ID 4625 mean?

Event ID 4625 records a failed Windows logon attempt on the computer where access was attempted. Status, SubStatus, LogonType, and source network fields explain the failure context.

Does one Event ID 4625 prove a brute-force attack?

No. A single failure is commonly caused by a mistyped or stale password; detection requires correlation by account, source, failure code, logon type, time window, and any subsequent successful logon.

Which 4625 value is most useful for password guessing?

SubStatus 0xC000006A identifies a valid account with a bad password, while 0xC0000064 identifies an unknown account and is more consistent with username enumeration.

Sources