Event 4625 Failure Code Lookup
Paste a 4625 event and decode the Status and Sub Status codes: which one means wrong password, which means locked out, and what to check before resetting anything.
A 4625 event always carries two codes, and they answer different questions. Status is the general outcome; Sub Status is the reason. Most people read the first one, see 0xC000006D, and start resetting passwords that were never wrong.
Read Sub Status first
| Sub Status | What actually happened |
|---|---|
0xC000006A | User name is correct, password is wrong |
0xC0000064 | User name does not exist |
0xC0000234 | Account is locked out |
0xC0000071 | Password expired |
0xC0000072 | Account disabled |
0xC000006E | A restriction blocked it: hours, workstation, logon type or empty password |
0xC000006D on its own means “authentication failed” and tells you almost nothing. When it appears as Status with 0xC000006A as Sub Status, the account exists and the password is the problem.
Logon Type is the second half of the answer
Logon Type 3 at 03:00 from a server nobody is using is a stale credential in a service, a scheduled task or a mapped drive — not a person typing. Logon Type 10 from an unfamiliar address is someone at a keyboard over RDP. Same code, completely different investigation.
| Type | Source |
|---|---|
| 2 | Console or interactive |
| 3 | Network / SMB |
| 4 | Scheduled task |
| 5 | Service |
| 7 | Unlock |
| 10 | RDP |
Do not unlock before you find the source
Unlocking an account without finding what is still sending the bad password means it locks again within minutes, and the lockout counter keeps climbing. Find the caller first — event 4740 names the computer that triggered the lockout.