ZEKASTRA

SecurityLogon and session

4625 · An account failed to log on

Logged for any logon failure on the computer where the attempt was made. Status and SubStatus carry NTSTATUS codes that give the reason, such as a bad password or a disabled account.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • Status
  • FailureReason
  • SubStatus
  • LogonType
  • LogonProcessName
  • AuthenticationPackageName
  • WorkstationName
  • ProcessName
  • IpAddress
  • IpPort

02How to use it

Group by TargetUserName, IpAddress and SubStatus over time to separate password guessing, account enumeration (0xC0000064) and misconfigured services. Look for a 4624 for the same account and source after a run of failures.

Logon type table in the guide

03Caveats

Requires Audit Logon or Audit Account Lockout. In domains, the authoritative record of the credential check may be on the domain controller (4771, 4776) rather than on the target host.

05Sources

  1. Microsoft Learn — 4625(F) An account failed to log on checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.