Microsoft windows security auditing 4625

Sign up

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.

Free.

Examples of 4625

An account failed to log on.

Subject:
   Security ID:  NULL SID
   Account Name:  —
   Account Domain:  —
   Logon ID:  0x0
Logon Type:  3
Account For Which Logon Failed:
   Security ID:  NULL SID
   Account Name:  asdf
   Account Domain: 
Failure Information:
   Failure Reason:  Unknown user name or bad password.
   Status:   0xc000006d
   Sub Status:  0xc0000064
Process Information:
   Caller Process ID: 0x0
   Caller Process Name: —
Network Information:
   Workstation Name: WIN-R9H529RIO4Y
   Source Network Address: 10.42.42.201
   Source Port:  53176
Detailed Authentication Information:
      Logon Process:  NtLmSsp
   Authentication Package: NTLM
   Transited Services: —
   Package Name (NTLM only): —
   Key Length:  0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.

• Transited services indicate which intermediate services have participated in this logon request.
• Package name indicates which sub-protocol was used among the NTLM protocols
• Key length indicates the length of the generated session key. This will be 0 if no session key was requested

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

• How to Detect 2 Computers on Your Network Talking to Each Other for the First Time and Why It Matters
• Top 5 Ways for Analyzing Entitlements and Identifying High-Risk
• Top 12 Events to Monitor in the Windows Server Security Log
• How to Analyze Logon Attacks with the Windows Security Logs
• Anatomy of an Attack: How Password Spraying Exploits Weak Passwords So Effectively
• Correlating DHCP, DNS and Active Directory data with Network Logs for User Attribution
• 4 Threat Detections using Active Directory Authentication Events from the Windows Security Log
• Dabble or Deep Dive: 7 Different Threat Hunts You Can Do With Available Resources
• Auditing Active Directory Changes with the Windows Security Log
• Using Honeypot Accounts and Hashes in Active Directory to Detect Pass-the-Hash & Credential Theft
• Top 10 Event Categories to Monitor in the Windows Server Event Log
• Security Log Deep Dive: Mapping Active Directory Authentication and Account Management Events to MITRE ATT&CK TTPs
• Understanding Logon Events in the Windows Server 2022 Security Log
• Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs

• Remove From My Forums

• Question

• Windows 2008 R2 server has over 3000 audit failures in the last hour with the following description. Any help would be appreciated.

  An account failed to log on.

  Subject:
  Security
  ID:
   SYSTEM
  Account
  Name:
   PHS-AERO$
  Account
  Domain:
  PUSD
  Logon
  ID:
   0x3e7

  Logon Type:
  8

  Account For Which Logon Failed:
  Security
  ID:
   NULL SID
  Account
  Name:
   Administrator
  Account
  Domain:
  PUSD.local

  Failure Information:
  Failure
  Reason:
  Unknown user name or bad password.
  Status:
   0xc000006d
  Sub
  Status:
   0xc000006a

  Process Information:
  Caller
  Process ID:
  0x4b4
  Caller
  Process Name:
  C:\Windows\System32\svchost.exe

  Network Information:
  Workstation
  Name:
  PHS-AERO
  Source
  Network Address:
  —
  Source
  Port:
   —

  Detailed Authentication Information:
  Logon
  Process:
  Advapi  
  Authentication
  Package:
  Negotiate
  Transited
  Services:
  —
  Package
  Name (NTLM only):
  —
  Key
  Length:
   0

  This event is generated when a logon request fails. It is generated on the computer where access was attempted.

  The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

  The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

  The Process Information fields indicate which account and process on the system requested the logon.

  The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

  The authentication information fields provide detailed information about this specific logon request.
  —
  Transited services indicate which intermediate services have participated in this logon request.
  —
  Package name indicates which sub-protocol was used among the NTLM protocols.
  —
  Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

What is Event ID 4625: An Account Failed to Log On. Are you seeing a lot of event ID 4625 (An account failed to log on) in your Domain Controller’s Security logs and unsure what it means or how to resolve it? Well, in this article, we explains everything you need to know about this Active Directory security event log and how to fix the issue that triggers it.

First, we discuss the causes and various properties of Event ID 4625. This security event log provides information about the type of logon attempt, user account information, logon process, failure reason, client address, and event status and sub-status codes.

Next, we explain how to interpret these properties and use them to determine the root cause of the error that triggered the event log. This involves checking the username and password, account status, group membership, network connectivity, and related security events.

Once you have identified the problem, we also provide some general steps to fix event ID 4625. This may involve resetting passwords, re-enabling disabled accounts, adjusting group policies, troubleshooting network connectivity, or scanning for malware.

So, if you’re seeing a lot of event ID 4625 in your Domain Controller Security logs and want to fix the issue, keep reading to find out how!

Potential Causes of Event ID 4625: An Account Failed to Log On

The first step to troubleshooting and fixing the cause of event ID 4625 is to understand the possible things that could stop a user, service, or computer account from failing to log on. Here are the top reasons that may generate event ID 4625:

1. Incorrect username or password: if a user enters a wrong password, the account cannot log in. This makes the computer the user attempt to sign in to log event ID 4625.

   Moreover, if the password in a service account is wrong, it fails when the service account tries to authenticate to AD, and the Domain Controller also registers this event log. 

2. The user account has expired: when an admin creates an AD account, they set it to expire at a specified date.

   If an Active Directory user attempts to use an expired account to sign in to AD, the user is denied access. Then, the Domain Controller logs an event ID 4625. 

3. The account that attempted login has been disabled.
4. The user is restricted from logging in to a computer: did you know that as an admin, you use group policy to prevent a user or group from logging in to a computer?

   This is done using the “Deny log on locally” policy. If this policy is applied to a user and they try to log in to the computer, they are denied access. 

   When this happens, the computer registers event ID 4625 in its local Security event log when a user is denied access due to the policy.

Understanding the Properties of Event ID 4625: An Account Failed to Log On

When this event is logged in the Security event log, it typically includes information about the user account that failed to log on, the type of login attempt, and the reason for the failure. This information helps troubleshoot the issue and determines the appropriate action to fix the problem.

However, to use the information in the event log, you need to understand the relevant properties of the event ID and what they mean. 

Note that this event has numerous properties, but we discuss the properties you must learn to fix why an account failed to log on to the domain. 

Event ID 4625 Logon Type

Event ID 4625 User Account Information

Once you have identified the Logon Type of the event that triggered the Event ID 4625, the next crucial information in the event log is the user information. Locate this information in the “Account For Which Logon Failed:” section of the event log.

In this section, you find 3 pieces of information, but the most important one is the Account Name. If you are managing a multi-domain AD Forest, it is also essential to take note of the Account Domain. By keeping track of these details, you are better equipped to troubleshoot failed logon attempts.

Event ID 4625 Failure Information

The Failure information property of event ID 4625 has 3 sub-properties: Failure Reason,  Status Code, and Sub Status Code. While the “Failure Reason” gives you superficial information, for example, “Unknown user name or bad password,” the status code provides a specific reason for the failure. 

This information is essential because “Unknown user name or bad password” may not necessarily mean the user entered an incorrect user name or password. 

However, as shown in the highlighted part of the above screenshot, the status code is some code that you must interpret before using it. To learn about the status codes and their meaning, visit the event ID 4625 status codes link. 

Based on Microsoft’s information in the previous link, the status code in my screenshot – 0xC000006D – means “The attempted logon is invalid. This is either due to a bad username or authentication information.”

This info is still ambiguous. For a more specific reason for the log-on failure, check the meaning of the event ID’s sub-status code. 

Read about the sub status codes in the same link I provided earlier – event ID 4625 status codes. When I looked up the sub status code shown in my event 4625, it says “The specified account does not exist.”

Much better!

There we have my answer, the account the user attempted to log in with does not exist in Active Directory.

How to Troubleshoot and Fix Event ID 4625

To address the issue, you need to take a systematic approach to troubleshoot the root cause of the failed logon attempts.

Follow the general guidelines below to troubleshoot and fix the event ID 4625: An Account Failed to Log On.

Step 1: Review the Information in the Event Log

By following the 3 steps I discussed in the last section, get the following information from the event log:

Logon Type, The Account For Which Logon Failed, Failure Reason, Status, and Sub Status codes and their meaning. 

In my case, we record the following: 

Logon Type: 5 – a service account initiated the logon that triggered the event.
The Account For Which Logon Failed: ADSyncMSA817b9$
Failure Reason: Unknown user name or bad password.
Status and Meaning: 0xC000006D – The attempted logon is invalid. This is either due to a bad username or authentication information.
Sub Status and Meaning: 0xC0000064 – The specified account does not exist.

Step 2: Take Appropriate Steps to Resolve the Cause of Event ID 4625

Now that you have identified the account that caused the DC to record Event ID 4625, it’s time to take action and resolve the issue. For instance, in the case where a service account such as ADSyncMSA817b9$ is attempting to authenticate to the AD domain but the account does not exist, there are several steps to fix the problem.

Firstly, identify the service that uses this account and then create the missing account in the AD. Once you have created the account, enter the necessary details in the application that is making the authentication request. This allows the service to authenticate to the AD domain without issues.

General Guidelines to Fixing Event ID 4625

In general, fixing Event ID 4625 requires careful analysis of the information provided in the event log and a systematic approach to troubleshooting the issue. Following the steps discussed in this article, you should be able to successfully troubleshoot and fix event ID “4625: An Account Failed to Log On” event log issues.

By doing so, you improve the security of your Active Directory infrastructure and prevent further failed logon attempts.