Windows Event ID 4625 – Microsoft-Windows-Security-Auditing: An Account Failed to Log On

Start by examining the specific failure details in Event Viewer to understand the authentication failure context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4625 using Filter Current Log → Event IDs: 4625
3. Double-click a 4625 event to view detailed information
4. Check the Failure Reason field for the specific error description
5. Note the Sub Status code to identify the exact failure type:
   • 0xC0000064 - The specified user does not exist
   • 0xC000006A - The value provided as the current password is not correct
   • 0xC0000072 - The referenced account is currently disabled
   • 0xC0000193 - The referenced account has expired
   • 0xC0000234 - The referenced account is currently locked out
6. Review the Logon Type to understand the authentication method:
   • Type 2 - Interactive (console logon)
   • Type 3 - Network (accessing shared resources)
   • Type 10 - RemoteInteractive (RDP/Terminal Services)
7. Check Source Network Address to identify the origin of failed attempts

PowerShell provides powerful filtering and analysis capabilities for investigating 4625 events across multiple systems.

1. Query recent failed logon attempts:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

2. Filter failed logons by specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | Where-Object {$_.Message -like "*TargetUserName*"} | Select-Object TimeCreated, Message

3. Identify potential brute force attacks by counting failures per source IP:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)}
   $Events | ForEach-Object {
       $XML = [xml]$_.ToXml()
       [PSCustomObject]@{
           Time = $_.TimeCreated
           Account = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           SourceIP = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
           FailureReason = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubStatus'} | Select-Object -ExpandProperty '#text'
       }
   } | Group-Object SourceIP | Sort-Object Count -Descending

4. Export failed logon events for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\FailedLogons.csv" -NoTypeInformation

5. Check for account lockout patterns:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} | Where-Object {$_.Message -like "*0xC0000234*"} | Select-Object TimeCreated, Message

Ensure proper audit policy configuration to capture all relevant failed logon events and enhance security monitoring.

1. Check current audit policy settings:

   auditpol /get /category:"Logon/Logoff"

2. Enable detailed logon failure auditing:

   auditpol /set /subcategory:"Logon" /success:enable /failure:enable
   auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

3. Configure Group Policy for domain-wide audit settings:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Audit Policies → Logon/Logoff
   • Configure Audit Logon to Success and Failure
   • Configure Audit Account Lockout to Success and Failure
4. Verify audit policy application:

   gpresult /h C:\Temp\GPResult.html
   # Review Applied Group Policy Objects section

5. Test audit policy by generating a controlled failed logon:

   # From command prompt (will fail intentionally)
   runas /user:nonexistentuser cmd

6. Configure Security log size to handle increased event volume:
   • Open Event Viewer → Windows Logs → Security
   • Right-click Security → Properties
   • Set Maximum log size to at least 100 MB
   • Configure When maximum log size is reached to Archive the log automatically

Set up automated detection systems to identify and respond to suspicious failed logon patterns in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Save as Monitor-FailedLogons.ps1
   param(
       [int]$ThresholdCount = 5,
       [int]$TimeWindowMinutes = 10
   )
   
   $StartTime = (Get-Date).AddMinutes(-$TimeWindowMinutes)
   $FailedLogons = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4625
       StartTime=$StartTime
   } -ErrorAction SilentlyContinue
   
   if ($FailedLogons) {
       $GroupedByIP = $FailedLogons | ForEach-Object {
           $XML = [xml]$_.ToXml()
           [PSCustomObject]@{
               SourceIP = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'IpAddress'} | Select-Object -ExpandProperty '#text'
               Account = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           }
       } | Group-Object SourceIP
       
       foreach ($Group in $GroupedByIP) {
           if ($Group.Count -ge $ThresholdCount) {
               Write-Warning "ALERT: $($Group.Count) failed logons from $($Group.Name) in last $TimeWindowMinutes minutes"
               # Add email notification or SIEM integration here
           }
       }
   }

2. Schedule the monitoring script using Task Scheduler:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-FailedLogons.ps1"
   $Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   Register-ScheduledTask -TaskName "Monitor Failed Logons" -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest

3. Configure Windows Event Forwarding for centralized monitoring:
   • On collector server, enable WinRM:

     winrm quickconfig -y
     wecutil qc

   • Create subscription configuration file:

     <?xml version="1.0" encoding="UTF-8"?>
     <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
         <SubscriptionId>FailedLogons</SubscriptionId>
         <SubscriptionType>SourceInitiated</SubscriptionType>
         <Description>Forward Event ID 4625 from domain computers</Description>
         <Enabled>true</Enabled>
         <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
         <Query><![CDATA[<QueryList><Query Id="0"><Select Path="Security">*[System[(EventID=4625)]]</Select></Query></QueryList>]]></Query>
     </Subscription>

   • Create the subscription:

     wecutil cs C:\Config\FailedLogons.xml

4. Integrate with Microsoft Sentinel or third-party SIEM:
   • Install Azure Monitor Agent on domain controllers
   • Configure Security Events data connector in Sentinel
   • Create analytics rules for failed logon detection

Perform deep forensic analysis of failed logon events to identify attack patterns and implement targeted countermeasures.

1. Extract detailed forensic data using advanced PowerShell techniques:

   # Advanced 4625 analysis script
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)}
   $DetailedAnalysis = foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = @{}
       $XML.Event.EventData.Data | ForEach-Object {
           $EventData[$_.Name] = $_.'#text'
       }
       
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           TargetUserName = $EventData.TargetUserName
           TargetDomainName = $EventData.TargetDomainName
           WorkstationName = $EventData.WorkstationName
           IpAddress = $EventData.IpAddress
           IpPort = $EventData.IpPort
           LogonType = $EventData.LogonType
           LogonProcessName = $EventData.LogonProcessName
           AuthenticationPackageName = $EventData.AuthenticationPackageName
           FailureReason = $EventData.FailureReason
           Status = $EventData.Status
           SubStatus = $EventData.SubStatus
           ProcessName = $EventData.ProcessName
           KeyLength = $EventData.KeyLength
       }
   }
   
   # Analyze attack patterns
   $DetailedAnalysis | Group-Object IpAddress | Sort-Object Count -Descending | Select-Object Name, Count, @{n='UniqueAccounts';e={($_.Group | Select-Object -Unique TargetUserName).Count}}

2. Correlate with other security events for timeline analysis:

   # Correlate 4625 with successful logons (4624) and account lockouts (4740)
   $TimeRange = @{StartTime=(Get-Date).AddHours(-2); EndTime=Get-Date}
   $FailedLogons = Get-WinEvent -FilterHashtable (@{LogName='Security'; Id=4625} + $TimeRange)
   $SuccessfulLogons = Get-WinEvent -FilterHashtable (@{LogName='Security'; Id=4624} + $TimeRange)
   $AccountLockouts = Get-WinEvent -FilterHashtable (@{LogName='Security'; Id=4740} + $TimeRange)
   
   # Create timeline of events
   $AllEvents = @($FailedLogons + $SuccessfulLogons + $AccountLockouts) | Sort-Object TimeCreated
   $AllEvents | Select-Object TimeCreated, Id, @{n='EventType';e={switch($_.Id){4625{'Failed Logon'};4624{'Successful Logon'};4740{'Account Lockout'}}}}, Message

3. Implement IP address reputation checking:

   # Check suspicious IPs against threat intelligence
   $SuspiciousIPs = $DetailedAnalysis | Group-Object IpAddress | Where-Object {$_.Count -gt 10} | Select-Object -ExpandProperty Name
   
   foreach ($IP in $SuspiciousIPs) {
       if ($IP -and $IP -ne '-' -and $IP -ne '::1' -and $IP -ne '127.0.0.1') {
           try {
               $GeoLocation = Invoke-RestMethod -Uri "http://ip-api.com/json/$IP" -TimeoutSec 5
               Write-Host "IP: $IP - Country: $($GeoLocation.country) - ISP: $($GeoLocation.isp)" -ForegroundColor Yellow
           } catch {
               Write-Host "IP: $IP - Geolocation lookup failed" -ForegroundColor Red
           }
       }
   }

4. Generate comprehensive security report:

   # Generate detailed security report
   $Report = @"
   === Failed Logon Analysis Report ===
   Generated: $(Get-Date)
   Time Range: Last 24 hours
   
   Summary:
   - Total Failed Logons: $($DetailedAnalysis.Count)
   - Unique Source IPs: $(($DetailedAnalysis | Select-Object -Unique IpAddress).Count)
   - Unique Target Accounts: $(($DetailedAnalysis | Select-Object -Unique TargetUserName).Count)
   
   Top 10 Source IPs by Failed Attempts:
   $($DetailedAnalysis | Group-Object IpAddress | Sort-Object Count -Descending | Select-Object -First 10 | Format-Table Name, Count -AutoSize | Out-String)
   
   Top 10 Targeted Accounts:
   $($DetailedAnalysis | Group-Object TargetUserName | Sort-Object Count -Descending | Select-Object -First 10 | Format-Table Name, Count -AutoSize | Out-String)
   
   Failure Reason Distribution:
   $($DetailedAnalysis | Group-Object SubStatus | Sort-Object Count -Descending | Format-Table Name, Count -AutoSize | Out-String)
   "@
   
   $Report | Out-File -FilePath "C:\Temp\FailedLogonReport_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"

5. Implement automated response actions:

   # Automated response for high-risk scenarios
   $HighRiskIPs = $DetailedAnalysis | Group-Object IpAddress | Where-Object {$_.Count -gt 20}
   
   foreach ($RiskIP in $HighRiskIPs) {
       if ($RiskIP.Name -and $RiskIP.Name -notmatch '^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.)') {
           Write-Warning "High-risk IP detected: $($RiskIP.Name) with $($RiskIP.Count) failed attempts"
           
           # Add Windows Firewall rule to block IP
           try {
               New-NetFirewallRule -DisplayName "Block Brute Force IP $($RiskIP.Name)" -Direction Inbound -RemoteAddress $RiskIP.Name -Action Block -Protocol TCP
               Write-Host "Firewall rule created to block $($RiskIP.Name)" -ForegroundColor Green
           } catch {
               Write-Error "Failed to create firewall rule for $($RiskIP.Name): $($_.Exception.Message)"
           }
       }
   }