EventID Windows Server

Event ID 4625: An account failed to log on

Windows Server high severity security-loglogonactive-directory
An account failed to log on.

Subject:
  Security ID:		NULL SID
  Account Name:		-

Logon Type:		3

Account For Which Logon Failed:
  Security ID:		NULL SID
  Account Name:		jsmith
  Account Domain:		CORP

Failure Information:
  Status:		0xC000006D
  Sub Status:		0xC000006A
On this page

What you see

The Security log fills with 4625 events. Each one records a failed logon, but not every 4625 is an attack — service accounts with stale passwords produce them continuously.

Read these three fields first

Logon Type tells you where the attempt came from:

TypeMeaning
2Interactive, at the console
3Network, SMB or a mapped drive
4Batch, scheduled task
5Service
7Unlock
10Remote Desktop

Sub Status tells you why it failed:

Sub StatusMeaning
0xC000006AWrong password
0xC0000064Account does not exist
0xC0000234Account is locked out
0xC0000072Account is disabled
0xC0000071Password expired
0xC000006FOutside allowed logon hours
0xC0000133Clock skew between client and DC
0xC000015BLogon type not granted to this account

Workstation Name / Source Network Address tells you which machine is retrying.

Fix

1. Pull the failures with the useful fields only.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 200 |
  ForEach-Object {
    $x = [xml]$_.ToXml()
    [pscustomobject]@{
      Time     = $_.TimeCreated
      Account  = $x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName' | ForEach-Object '#text'
      Type     = $x.Event.EventData.Data | Where-Object Name -eq 'LogonType' | ForEach-Object '#text'
      SubStatus= $x.Event.EventData.Data | Where-Object Name -eq 'SubStatus' | ForEach-Object '#text'
      Source   = $x.Event.EventData.Data | Where-Object Name -eq 'IpAddress' | ForEach-Object '#text'
    }
  } | Group-Object Account, SubStatus | Sort-Object Count -Descending

2. Match the failure to its cause.

  • Wrong password on type 3, every few minutes, from one host: a mapped drive or saved credential with an old password
  • Wrong password on type 5: a service account whose password was changed in AD but not in the service configuration
  • 0xC0000234: the account is already locked, see Event ID 4740
  • 0xC0000133: fix time sync, w32tm /resync on the client

3. Clear stale credentials on the source machine.

control keymgr.dll

Remove entries for the server, then reconnect.

4. If the source is unknown or external, treat it as hostile.

Check the firewall for exposed RDP or SMB, and review 4625 volume by source IP. Repeated 0xC000006A from one address is password guessing, not a broken client.

Verify

After fixing the source, filter again and confirm no new 4625 for that account:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddMinutes(-15)} |
  Where-Object { $_.Message -match 'jsmith' }

More event IDs