Windows Event ID 4625 – Microsoft-Windows-Security-Auditing: An Account Failed to Log On

Start by examining the specific 4625 event details to understand the failure reason and context.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4625 or search for recent failures
3. Double-click the event to view detailed properties
4. Note the Account Name, Workstation Name, and Source Network Address
5. Check the Logon Type field to understand the authentication method:
   • Type 2: Interactive (local console logon)
   • Type 3: Network (file shares, mapped drives)
   • Type 4: Batch (scheduled tasks)
   • Type 5: Service (Windows services)
   • Type 10: RemoteInteractive (RDP, Terminal Services)
6. Examine the Failure Reason and Status/Sub Status codes:
   • 0xC000006A: Wrong password
   • 0xC0000072: Account disabled
   • 0xC000006F: Logon outside allowed time
   • 0xC0000070: Workstation restriction
   • 0xC0000193: Account expired
   • 0xC0000071: Password expired

Use PowerShell to efficiently query and analyze multiple 4625 events for patterns or specific accounts.

1. Open PowerShell as Administrator
2. Query recent logon failures with basic filtering:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName

3. Extract detailed information from specific events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 100
   $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           Account = $Event.Event.EventData.Data[5].'#text'
           Workstation = $Event.Event.EventData.Data[13].'#text'
           SourceIP = $Event.Event.EventData.Data[19].'#text'
           LogonType = $Event.Event.EventData.Data[10].'#text'
           Status = $Event.Event.EventData.Data[7].'#text'
           SubStatus = $Event.Event.EventData.Data[9].'#text'
       }
   } | Format-Table -AutoSize

4. Filter for specific accounts or time ranges:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like "*username*"}

5. Count failures by source IP to identify potential attacks:

   $FailureEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 1000
   $FailureEvents | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $Event.Event.EventData.Data[19].'#text'
   } | Group-Object | Sort-Object Count -Descending | Select-Object Name, Count

Investigate the target account's current status and applicable policies that might cause authentication failures.

1. For domain accounts, open Active Directory Users and Computers
2. Locate the failing account and check its properties:
   • Account tab: Verify account is not disabled or locked out
   • Account tab: Check account expiration date
   • Account tab: Review logon hours restrictions
   • Account tab: Examine "Log On To" workstation restrictions
3. For local accounts, use PowerShell to check status:

   Get-LocalUser -Name "username" | Select-Object Name, Enabled, AccountExpires, PasswordExpired, LastLogon

4. Check account lockout status in domain environments:

   Search-ADAccount -LockedOut | Select-Object Name, LockedOut, LastLogonDate

5. Review password policy settings affecting the account:

   Get-ADDefaultDomainPasswordPolicy

6. For service accounts, verify the service configuration:

   Get-Service | Where-Object {$_.StartType -eq "Automatic"} | ForEach-Object {
       $Service = Get-WmiObject -Class Win32_Service -Filter "Name='$($_.Name)'"
       if ($Service.StartName -like "*username*") {
           [PSCustomObject]@{
               ServiceName = $Service.Name
               StartName = $Service.StartName
               State = $Service.State
           }
       }
   }

Investigate network-related authentication failures, particularly for domain environments and remote access scenarios.

1. Check domain controller connectivity from the failing workstation:

   Test-ComputerSecureChannel -Verbose

2. Verify DNS resolution for domain controllers:

   nslookup -type=SRV _ldap._tcp.dc._msdcs.domain.com

3. Test Kerberos authentication specifically:

   klist purge
   klist tgt

4. For RDP failures (Logon Type 10), check Terminal Services configuration:
   • Open Group Policy Management
   • Navigate to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services
   • Review "Limit number of connections" and "Set time limit for disconnected sessions"
5. Examine network authentication events on domain controllers:

   Get-WinEvent -ComputerName "DC01" -FilterHashtable @{LogName='Security'; Id=4625,4771,4776} -MaxEvents 100 | Where-Object {$_.Message -like "*username*"}

6. Check for time synchronization issues that affect Kerberos:

   w32tm /query /status

7. Review firewall logs for blocked authentication traffic:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'; Id=5152,5157} -MaxEvents 50

Set up comprehensive monitoring to detect attack patterns and automate response to suspicious authentication failures.

1. Create custom Event Viewer filters for security monitoring:
   • Open Event Viewer → Custom Views → Create Custom View
   • Select By log → Security
   • Include Event IDs: 4625, 4624, 4648, 4771, 4776
   • Save as "Authentication Monitoring"
2. Configure advanced PowerShell monitoring script:

   $ScriptBlock = {
       $Threshold = 5  # Failed attempts threshold
       $TimeWindow = 300  # 5 minutes in seconds
       
       $FailedLogons = Get-WinEvent -FilterHashtable @{
           LogName='Security'
           Id=4625
           StartTime=(Get-Date).AddSeconds(-$TimeWindow)
       } | ForEach-Object {
           $Event = [xml]$_.ToXml()
           [PSCustomObject]@{
               TimeCreated = $_.TimeCreated
               SourceIP = $Event.Event.EventData.Data[19].'#text'
               Account = $Event.Event.EventData.Data[5].'#text'
           }
       }
       
       $SuspiciousIPs = $FailedLogons | Group-Object SourceIP | Where-Object {$_.Count -ge $Threshold}
       
       if ($SuspiciousIPs) {
           $SuspiciousIPs | ForEach-Object {
               Write-EventLog -LogName "Application" -Source "Security Monitor" -EventId 1001 -EntryType Warning -Message "Potential brute force attack detected from IP: $($_.Name) with $($_.Count) failed attempts"
           }
       }
   }
   
   # Register as scheduled task
   Register-ScheduledTask -TaskName "AuthFailureMonitor" -Trigger (New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -Once -At (Get-Date)) -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-WindowStyle Hidden -Command $ScriptBlock")

3. Set up Windows Event Forwarding for centralized logging:
   • Configure source computers: winrm quickconfig
   • On collector server, run: wecutil qc
   • Create subscription: wecutil cs subscription.xml
4. Implement automated account lockout response:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-ADUser -Filter {LockedOut -eq $true} | Unlock-ADAccount"
   $Trigger = New-ScheduledTaskTrigger -AtLogOn
   Register-ScheduledTask -TaskName "AutoUnlock" -Action $Action -Trigger $Trigger

5. Configure SIEM integration using Windows Event Forwarding or Syslog:

   # Example: Forward to Syslog server
   $SyslogServer = "192.168.1.100"
   $Port = 514
   
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 1 | ForEach-Object {
       $Message = "$($_.TimeCreated) $($env:COMPUTERNAME) Security: $($_.Message)"
       $Bytes = [System.Text.Encoding]::UTF8.GetBytes($Message)
       $UdpClient = New-Object System.Net.Sockets.UdpClient
       $UdpClient.Send($Bytes, $Bytes.Length, $SyslogServer, $Port)
       $UdpClient.Close()
   }