Event ID 4625: failed logon
What Event ID 4625 (failed logon) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4625 is a failed logon. One or two are a typo. Hundreds are either an attack or, more often than anyone likes, a laptop or service with an old saved password. The Sub Status code and the source address settle which in a minute.
The fields that matter
| Field | What it tells you |
|---|---|
| Status / Sub Status | Why it failed. 0xC000006A wrong password, 0xC0000064 no such user, 0xC0000234 locked out, 0xC0000072 disabled. |
| Logon Type | 3 for network and SMB, 10 for RDP without NLA, 8 for basic-auth web apps, 4 and 5 for tasks and services. |
| Account For Which Logon Failed | The account being tried. |
| Source Network Address | Where the attempt came from. |
| Workstation Name | The name the client sent. Attack tools often send random or blank names. |
What is normal
A handful of failures followed by a success from the user's usual device, or a steady trickle from one internal server for one account (a stale password).
When Event ID 4625 is suspicious
- Ten or more failures for one account within ten minutes: brute force.
- One source failing against five or more different accounts: password spraying, often with
0xC0000064for names that don't exist. - Failures from a public IP on RDP or SMB.
- Failures for disabled or departed accounts.
Common false positive: Service accounts and scheduled tasks with an old password fail around the clock from the same server. Fix the credential instead of raising the threshold.
Find Event ID 4625 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4625
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4624: Successful logon
- Event ID 4740: Account locked out
- Event ID 4771: Kerberos pre-authentication failed
- Event ID 4776: NTLM credential validation
For a full walk-through, read Event ID 4625: failed logons explained.
FAQ
Why is the Source Network Address "-"?
The attempt did not come over the network: someone tried at the console or lock screen, or a local process tried to authenticate.
Where do failures for domain accounts show up on the domain controller?
As 4771 for Kerberos pre-authentication and 4776 for NTLM. Hunt for spraying across the domain with those.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.