Windows Event ID 4625 – Microsoft-Windows-Security-Auditing: An Account Failed to Log On

Start by examining the specific failure details in Event Viewer to understand the authentication failure context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4625 using Filter Current Log → Event IDs: 4625
3. Double-click a recent 4625 event to view detailed information
4. Focus on these critical fields:
   • Account Name: The account that failed authentication
   • Failure Reason: Specific error code (0xC000006A = wrong password, 0xC0000072 = account disabled)
   • Logon Type: Authentication method (2=Interactive, 3=Network, 10=RemoteInteractive)
   • Source Network Address: IP address of authentication attempt
   • Workstation Name: Computer name where attempt originated
5. Cross-reference the Sub Status code with Microsoft documentation for precise failure reasons
6. Note the timestamp pattern to identify potential attack sequences

Use PowerShell to analyze 4625 events programmatically and identify suspicious patterns or frequent failures.

1. Query recent logon failures with detailed information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 100 | 
   Select-Object TimeCreated, @{Name='Account';Expression={$_.Properties[5].Value}}, 
   @{Name='SourceIP';Expression={$_.Properties[19].Value}}, 
   @{Name='FailureReason';Expression={$_.Properties[8].Value}} | 
   Format-Table -AutoSize

2. Identify accounts with multiple failures in the last 24 hours:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)}
   $FailuresByAccount = $Events | Group-Object {$_.Properties[5].Value} | 
   Sort-Object Count -Descending
   $FailuresByAccount | Select-Object Name, Count | Format-Table

3. Analyze source IP addresses for potential attack sources:

   $Events | Group-Object {$_.Properties[19].Value} | 
   Where-Object {$_.Count -gt 10} | 
   Sort-Object Count -Descending | 
   Select-Object Name, Count

4. Export detailed failure analysis to CSV for further investigation:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-4)} | 
   ForEach-Object {
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           Account = $_.Properties[5].Value
           Domain = $_.Properties[6].Value
           SourceIP = $_.Properties[19].Value
           Workstation = $_.Properties[13].Value
           LogonType = $_.Properties[10].Value
           FailureReason = $_.Properties[8].Value
           SubStatus = $_.Properties[9].Value
       }
   } | Export-Csv -Path "C:\Temp\LogonFailures.csv" -NoTypeInformation

Optimize audit policy settings and implement automated monitoring for proactive security incident detection.

1. Verify current audit policy configuration:

   auditpol /get /category:"Logon/Logoff"

2. Enable detailed logon auditing if not already configured:

   auditpol /set /subcategory:"Logon" /success:enable /failure:enable
   auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

3. Configure Security log size to handle increased event volume:
   • Open Event Viewer → Windows Logs → Security
   • Right-click Security → Properties
   • Set Maximum log size to at least 100MB for busy systems
   • Configure Archive the log when full for retention
4. Create a scheduled task for automated failure monitoring:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorLogonFailures.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "06:00"
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "Monitor Logon Failures" -Action $Action -Trigger $Trigger -Principal $Principal

5. Implement real-time monitoring with Windows Event Forwarding (WEF) for centralized collection
6. Configure custom Event Viewer views for quick failure analysis:
   • Create Custom Views → Create Custom View
   • Filter by Event ID 4625 with specific failure reason codes
   • Save views for different failure types (brute force, account issues, etc.)

Perform comprehensive security incident investigation when 4625 events indicate potential attacks or account compromise.

1. Correlate 4625 events with account lockout events (4740):

   $StartTime = (Get-Date).AddHours(-2)
   $LockoutEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=$StartTime}
   $FailureEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$StartTime}
   
   foreach ($Lockout in $LockoutEvents) {
       $Account = $Lockout.Properties[0].Value
       $RelatedFailures = $FailureEvents | Where-Object {$_.Properties[5].Value -eq $Account}
       Write-Host "Account $Account locked at $($Lockout.TimeCreated)"
       Write-Host "Related failures: $($RelatedFailures.Count)"
   }

2. Analyze authentication patterns for the affected account:

   $TargetAccount = "username"
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=(Get-Date).AddDays(-7)} | 
   Where-Object {($_.Id -eq 4624 -or $_.Id -eq 4625) -and $_.Properties[5].Value -eq $TargetAccount}
   
   $Events | Select-Object Id, TimeCreated, @{Name='Result';Expression={if($_.Id -eq 4624){"Success"}else{"Failure"}}}, 
   @{Name='SourceIP';Expression={$_.Properties[18].Value}} | 
   Sort-Object TimeCreated | Format-Table

3. Check for successful logons immediately after failures (potential compromise):

   $Failures = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)}
   $Successes = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-1)}
   
   foreach ($Failure in $Failures) {
       $Account = $Failure.Properties[5].Value
       $FailureTime = $Failure.TimeCreated
       $SubsequentSuccess = $Successes | Where-Object {
           $_.Properties[5].Value -eq $Account -and 
           $_.TimeCreated -gt $FailureTime -and 
           $_.TimeCreated -lt $FailureTime.AddMinutes(10)
       }
       if ($SubsequentSuccess) {
           Write-Warning "Potential compromise: $Account failed at $FailureTime, succeeded at $($SubsequentSuccess.TimeCreated)"
       }
   }

4. Generate comprehensive incident report:

   $Report = @()
   $UniqueAccounts = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | 
       Group-Object {$_.Properties[5].Value}).Name
   
   foreach ($Account in $UniqueAccounts) {
       $AccountFailures = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | 
           Where-Object {$_.Properties[5].Value -eq $Account}
       
       $Report += [PSCustomObject]@{
           Account = $Account
           FailureCount = $AccountFailures.Count
           FirstFailure = ($AccountFailures | Sort-Object TimeCreated)[0].TimeCreated
           LastFailure = ($AccountFailures | Sort-Object TimeCreated -Descending)[0].TimeCreated
           UniqueSourceIPs = ($AccountFailures | Group-Object {$_.Properties[19].Value}).Count
           MostCommonFailure = ($AccountFailures | Group-Object {$_.Properties[8].Value} | Sort-Object Count -Descending)[0].Name
       }
   }
   
   $Report | Sort-Object FailureCount -Descending | Format-Table

Deploy enterprise-grade monitoring and automated response capabilities for large-scale 4625 event management.

1. Configure Windows Event Forwarding for centralized collection:

   # On collector server
   wecutil qc /q
   wecutil cs subscription.xml
   
   # Create subscription.xml with 4625 event filtering
   $SubscriptionXML = @"
   
       Security-Logon-Failures
       SourceInitiated
       Collect logon failure events
       true
       http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog
       Normal
       
               
                   *[System[(EventID=4625)]]
               
           
       ]]>
   
   "@
   $SubscriptionXML | Out-File -FilePath "C:\Temp\subscription.xml"

2. Create PowerShell-based alerting system:

   # Save as MonitorLogonFailures.ps1
   param(
       [int]$ThresholdCount = 10,
       [int]$TimeWindowMinutes = 15
   )
   
   $StartTime = (Get-Date).AddMinutes(-$TimeWindowMinutes)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$StartTime}
   
   $AccountFailures = $Events | Group-Object {$_.Properties[5].Value} | 
       Where-Object {$_.Count -ge $ThresholdCount}
   
   if ($AccountFailures) {
       $AlertMessage = "High logon failure count detected:`n"
       foreach ($Account in $AccountFailures) {
           $AlertMessage += "Account: $($Account.Name) - Failures: $($Account.Count)`n"
       }
       
       # Send email alert (configure SMTP settings)
       Send-MailMessage -To "security@company.com" -From "alerts@company.com" \
           -Subject "Security Alert: Multiple Logon Failures" -Body $AlertMessage \
           -SmtpServer "smtp.company.com"
       
       # Log to Application event log
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 \
           -EntryType Warning -Message $AlertMessage
   }

3. Implement automated account lockout response:

   # Automated response script
   $SuspiciousIPs = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddMinutes(-10)} | 
       Group-Object {$_.Properties[19].Value} | 
       Where-Object {$_.Count -gt 20} | 
       Select-Object -ExpandProperty Name
   
   foreach ($IP in $SuspiciousIPs) {
       if ($IP -ne "-" -and $IP -ne "127.0.0.1") {
           # Block IP using Windows Firewall
           New-NetFirewallRule -DisplayName "Block Suspicious IP $IP" \
               -Direction Inbound -RemoteAddress $IP -Action Block
           
           Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1002 \
               -EntryType Warning -Message "Automatically blocked suspicious IP: $IP"
       }
   }

4. Configure custom performance counters for monitoring:

   # Create custom performance counter for logon failures
   $CounterPath = "\Security Events\Logon Failures per Minute"
   typeperf $CounterPath -si 60 -o "C:\Logs\LogonFailures.csv"

5. Integrate with Microsoft Sentinel or third-party SIEM:
   • Configure Azure Monitor Agent for log forwarding
   • Create KQL queries for advanced pattern detection
   • Set up automated playbooks for incident response
   • Implement machine learning-based anomaly detection