Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Windows Security Log · Event 4625
Something tried to sign in to this machine and was rejected. On a home PC it is almost always a mistyped password or a stale saved credential. In bulk, from one source, against many usernames, it is password guessing.
Also written as 4625Event ID 4625Audit Failure 4625An account failed to log on
If you just fumbled your PIN or password, this is that. It also fires when a phone, printer, or backup drive on your network still remembers an old password for your PC — that one repeats every few minutes until you fix the saved credential on the other device.
Baseline it per-host before alerting. The useful alert shapes are: one source IP against many distinct TargetUserNames (spraying), one account across many hosts (credential stuffing), and any failure where LogonType is 10 from outside your management ranges.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Logon Type: 3
Account For Which Logon Failed:
Account Name: jbrooks
Account Domain: CORP
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A
Network Information:
Workstation Name: -
Source Network Address: 192.0.2.44
Source Port: 51244
Process Information:
Caller Process Name: -Everything else in the log line is context.
2Someone typed it at the physical keyboard. 3Over the network — file shares, printers, remote administration. 5A Windows service starting under a stored account. Repeats forever if the password changed. 8Network sign-in with the password sent in cleartext. Rare and usually worth explaining. 10Remote Desktop. From an unexpected address this is the one to chase. 0xC000006ACorrect username, wrong password. 0xC0000064That username does not exist. Many of these in a row means someone is guessing account names. 0xC0000234The account is locked out. 0xC0000072The account is disabled. 0xC000006FOutside the hours this account is permitted to sign in. 0xC0000070Not allowed to sign in from this workstation. Most of the time it is one of these.
What gives it awayMany distinct TargetUserName values from a single IpAddress, typically one or two attempts per account, often spaced out over hours.
ATT&CK T1110.003What gives it awayOne TargetUserName, high volume, SubStatus 0xC000006A repeating, frequently ending in a 4740 lockout.
ATT&CK T1110.001What gives it awayA run of 0xC0000064 failures — the attacker is discovering which names are real before trying passwords.
ATT&CK T1589.002What gives it awayLogonType 10 with public source addresses. If you see this, RDP is reachable from outside and that is the finding, regardless of whether anyone got in.
ATT&CK T1110.001SecurityEvent | where EventID == 4625 | summarize Attempts = count(), Accounts = dcount(TargetUserName) by IpAddress, bin(TimeGenerated, 1h) | where Accounts > 5 | order by Accounts descGet-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='Source';e={$_.Properties[19].Value}}index=wineventlog EventCode=4625 | stats count dc(Account_Name) as unique_accounts by Source_Network_Address | where unique_accounts > 5On its own, no. It records a failed sign-in, and the overwhelming majority are typing mistakes or a device on your network still using a password you changed. It becomes worth investigating when it repeats steadily without you touching the machine, or when the source address is not one of yours.
A repeating failure with no human involved is almost always a saved credential somewhere. Check Windows services and scheduled tasks running under a specific user account, then any phone, printer, NAS, or mapped drive that connects to the machine. Update the stored password on whichever one is stale.
Status is the general result and is usually the same value for every failure, which makes it useless for diagnosis. Sub Status carries the specific reason — wrong password, unknown username, disabled account, locked out. Always read Sub Status.
No. 4625 is only recorded when a sign-in was refused. To find out whether anyone succeeded, look for Event 4624 from the same source address around the same time.
Last reviewed 28 August 2026