Event ID 4625 records a failed logon attempt in the Security log on the computer where the attempt was made. It is useful for spotting password guessing, misconfigured services and account lockouts. Review Logon Type, Status, Sub Status and Source Network Address, and ensure Audit Logon and Audit Account Lockout are enabled.
Why Event ID 4625 is a useful signal, not just a noisy log entry
Event ID 4625 becomes valuable because it is a concrete indicator of failed authentication activity on the host where the attempt landed. Security teams use it to separate ordinary user mistakes from patterns that suggest password spraying, bad service credentials, or recurring lockouts. The event is most useful when you trend it over time and correlate it with source, logon type, and account behavior.
That makes 4625 a practical early-warning signal for both active attack attempts and operational failures. A few isolated failures may be benign, but repeated failures against the same account, from the same source, or across many accounts can reveal different problems that need different responses. The event is only actionable when it is reviewed in context, not as a standalone alert.
How to read the fields that matter most
The highest-value triage fields are Logon Type, Status, Sub Status, and Source Network Address. Logon Type tells you what kind of logon was attempted, which helps distinguish interactive use, remote access, service authentication, or network logons. Status and Sub Status explain whether the failure was due to bad credentials, lockout, account restrictions, or another policy issue.
Source Network Address is especially important because it helps separate local user error from distributed or remote activity. If the source is internal infrastructure, the problem may be a misconfigured service, scheduled task, or application pool. If the source is external or unexpectedly broad, the pattern may deserve investigation as a guessing campaign or lateral movement attempt. For structured Windows log analysis, NHIMG’s Windows Event Log Guide is a useful reference point for the surrounding audit and logon context.
What 4625 reveals about detection, tuning, and response
Event ID 4625 is often most useful when paired with other telemetry rather than treated as a lone trigger. Multiple failures followed by a successful logon can indicate credential guessing that eventually succeeded. Failures from a service account can point to expired passwords or broken automation. A spike in failures after a password reset can point to stale credentials still embedded in applications or scheduled jobs.
Detection teams should tune alerts around repetition, source diversity, account criticality, and failure type. One failed logon against a helpdesk user is not the same as repeated failures against an administrator, a service account, or a privileged remote access path. NHIMG’s SIEM Guide is relevant here because 4625 is most effective when onboarded into correlation, baselining, and alert triage workflows rather than reviewed as raw event noise.
Risk and Threat Considerations
Repeated 4625 events can expose weak passwords, stale service credentials, and misconfigured authentication paths. They also create ambiguity: the same event can reflect a harmless mistake, a failing application, or an active adversary probing for usable access. The risk grows when logging is present but follow-up logic is weak, because teams may miss the difference between background noise and an attack that is steadily iterating toward success.
Failure mechanism: Attackers or broken services generate repeated failed authentications until they find valid credentials, trigger lockouts, or reveal which accounts, hosts, and logon paths are worth targeting next.
Impact: The result can be account lockout, service interruption, password-spraying visibility gaps, and in the worst case, successful access after enough failed attempts have mapped the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Failed logons must be captured as auditable authentication events. |
| AU-6 — Audit Review, Analysis, and Reporting | 4625 is useful only when teams review and correlate failures for patterns. | |
| IA-5 — Authenticator Management | Repeated 4625s often indicate password, token, or credential lifecycle problems. | |
| Recommendation — Log failed logon activity and retain the fields needed for investigation. Analyze failed logon patterns for repetition, source clustering, and account targeting. Rotate or reset compromised or stale authenticators and remove exposed reuse. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Failed logons often expose access control weaknesses or stale credentials. |
| Recommendation — Review and tighten account access paths that produce repeated failed logons. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | 4625 is a monitoring signal for authentication anomalies and abuse. |
| Recommendation — Monitor failed logon trends and alert on abnormal authentication patterns. | ||
Practitioner Guidance
What to prioritise: Treat repeated 4625s against privileged users, service accounts, and remote-access endpoints as higher value than isolated single failures. Those patterns are more likely to signal either active abuse or an operational dependency that is brittle enough to create outage risk.
What to verify: Confirm that Audit Logon and Audit Account Lockout are enabled, then verify that the event pipeline preserves the source address, logon type, and status fields end to end. If those fields are missing, 4625 loses much of its investigative value.
Decision rule: If failures cluster around one account, suspect a credential or configuration issue first. If failures spread across many accounts or come from unusual sources, treat the pattern as possible guessing activity and escalate to identity, endpoint, and SIEM review together.
Practitioner takeaway: Event ID 4625 matters because it is a high-signal authentication failure, but it only becomes security-relevant when teams distinguish misconfiguration from adversarial repetition and act on the pattern, not the event alone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org