Event ID 4625: An account failed to log on
Written when a logon attempt fails: wrong password, unknown user, locked or disabled account, or a policy restriction.
- Log
- Security
- Category
- Logon
Why it matters
- Many failures for one account from one source is password guessing; a few failures each for many accounts from one source is password spraying.
- The Status and Sub Status codes say why it failed: 0xC000006A is a wrong password for a real account, 0xC0000064 is a user that does not exist.
- A run of failures followed by a 4624 success for the same account is the pattern to escalate.
What to check
Group by Source Network Address and Target Account Name over time. Check Logon Type, Status, Sub Status, Workstation Name and Process Name. Look for a later 4624 from the same source.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Logon (Failure).
Logon types
| Type | Name | Meaning |
|---|---|---|
| 2 | Interactive | At the keyboard or console. |
| 3 | Network | Over the network: file shares, many admin tools, PsExec, WMI. |
| 4 | Batch | Scheduled tasks. |
| 5 | Service | A service started by the Service Control Manager. |
| 7 | Unlock | Unlocking the workstation. |
| 8 | NetworkCleartext | Network logon with the password sent in cleartext, such as IIS basic authentication. |
| 9 | NewCredentials | runas /netonly: local identity unchanged, other credentials used for network access. |
| 10 | RemoteInteractive | Remote Desktop. |
| 11 | CachedInteractive | Logon with cached domain credentials, without contacting a domain controller. |
| 12 | CachedRemoteInteractive | Remote Desktop using cached credentials. |
| 13 | CachedUnlock | Unlock using cached credentials. |
Failure status codes
| Status / Sub Status | Meaning |
|---|---|
| 0xC0000064 | The user name does not exist. |
| 0xC000006A | The user name is correct but the password is wrong. |
| 0xC000006D | Bad user name or password (general). Check Sub Status for the specific reason. |
| 0xC000006E | Account restriction, such as a blank password not being allowed. |
| 0xC000006F | Logon outside the account's allowed hours. |
| 0xC0000070 | Logon from a workstation the account is not allowed to use. |
| 0xC0000071 | The password has expired. |
| 0xC0000072 | The account is disabled. |
| 0xC0000133 | Clocks on the client and domain controller are too far apart. |
| 0xC000015B | The user has not been granted this logon type on this machine. |
| 0xC0000193 | The account has expired. |
| 0xC0000224 | The user must change their password at next logon. |
| 0xC0000234 | The account is locked out. |
MITRE ATT&CK
- T1110 Brute Force
- T1110.003 Password Spraying