Skip to main content
AD Academy
Back to all events
4625Security (DC / client)AuthenticationWARNLast updated:

Failed logon

What it means

A logon attempt failed. Status/Sub Status explains why: 0xC000006A wrong password, 0xC0000064 no such user, 0xC0000234 account locked.

When it is normal and when it is suspicious

Normal: 1–3 failures on the first morning back. Suspicious: dozens per minute, or one account failing across many hosts (password spraying).

First steps

  1. 1Decode Sub Status — it separates a user typo from an attack.
  2. 2Many 0xC0000064 from one source means username enumeration.
  3. 3One password against many accounts is password spraying. Block the source.

Fields worth checking

FieldWhat to look at
Status / Sub Status0xC000006A = wrong password, 0xC0000064 = user does not exist, 0xC0000234 = account locked out.
Workstation NameWhich host tried — a name unknown in the domain is a red flag.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.