An account failed to log on

// EVENT DEFINITION:

An account failed to log on. Documents unsuccessful authentication attempts along with the failure reason code (e.g., 0xC000006D / 0xC000006A for incorrect password).

// DETAILED TELEMETRY & CONTEXT:

Event ID 4625 is generated when a user's logon request is rejected. It contains exact hexadecimal Status and Sub Status codes explaining why authentication failed—for instance, 0xC000006A indicates a correct username with an incorrect password, 0xC0000064 indicates a non-existent username, and 0xC0000234 indicates the account is currently locked out. It also identifies the workstation name and source IP address attempting the login.

[ ! ]Failure Reason / Root Cause Analysis

Expired or invalid credentials, brute-force or password spraying attacks, or misconfigured automated service accounts.

Operational Metadata & Applicability

Log Category:Logon/Logoff

Audit Type Classification:Failure Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

failurebrute forcepassword spray0xC000006A0xC000006Dinvalid credentialslogin attempt

MITRE ATT&CK Framework Alignment

T1110.001

Brute Force: Password GuessingTactic: Credential Access

T1110.003

Brute Force: Password SprayingTactic: Credential Access

Mitigation Playbook & Recommended SOC Actions

•Configure automated alerting when a single IP address generates more than 10 failed logon attempts within a 5-minute window.
•Investigate password spraying attacks where Event ID 4625 occurs across many unique usernames with Sub Status code 0xC000006A.
•Check if automated scripts or services are using outdated credentials after a password reset.

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.263Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to An account failed to log on -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)