EventID

Event 4625 Failure Code Lookup

Fri, 23 Oct 2026 14:00:00 +0800

A 4625 event always carries two codes, and they answer different questions. Status is the general outcome; Sub Status is the reason. Most people read the first one, see 0xC000006D, and start resetting passwords that were never wrong.

About EventID

Fri, 23 Oct 2026 12:00:00 +0800

EventID is a reference for Windows Server event IDs that are easy to find in the Event Viewer and hard to act on: a logon failure with three possible causes, a service that terminated without saying why, an account lockout with no obvious source.

Contact

Fri, 23 Oct 2026 12:00:00 +0800

Email: win@shenlijun.cn

Use it for:

An event whose fields differ from the page, usually because of a Windows version change
A command that failed or needed different privileges than described
A wrong interpretation of an error code
A dead link or a typo

What to include

Windows version and build (winver is enough)
The event as XML — Event Viewer → right-click → Copy → Event as XML, or Get-WinEvent -FilterHashtable @{LogName='System'; Id=<id>} -MaxEvents 1 | Format-List *
The page URL you were reading
What you expected instead

Do not send full logs or memory dumps. One event and the surrounding context is enough.

PowerShell Event Log Query Builder

Fri, 23 Oct 2026 12:00:00 +0800

Why not just open Event Viewer

Filtering in the GUI is fine for one event. The moment you need to compare a week of 4625s, or hand the query to a colleague, a command is faster and repeatable.

Privacy Policy

Fri, 23 Oct 2026 12:00:00 +0800

Last updated: 23 October 2026

EventID is a static website. There are no accounts, no comment forms, and no newsletter. This page explains the small amount of data that does pass through the site.

Event ID 7031: Service terminated unexpectedly

Fri, 23 Oct 2026 11:00:00 +0800

What you see

System log shows 7031, sometimes followed by 7034 (terminated unexpectedly, no recovery) or 7000/7009 (failed to start). Users notice the feature before you notice the log.

Why it happens

7031 is the Service Control Manager reporting a death it did not order. The service process exited or was killed:

Event ID 4740: A user account was locked out

Fri, 23 Oct 2026 10:00:00 +0800

What you see

The user cannot sign in, and the helpdesk unlocks the account. Ten minutes later it locks again. The Security log on the domain controller shows 4740 with the same Caller Computer Name each time.

Event ID 4625: An account failed to log on

Fri, 23 Oct 2026 09:00:00 +0800

What you see

The Security log fills with 4625 events. Each one records a failed logon, but not every 4625 is an attack — service accounts with stale passwords produce them continuously.