Event ID 4625 records a failed logon attempt in the Windows Security log. It is generated on the computer where the attempt occurred, including domain controllers, member servers, and workstations. Defenders use Logon Type, Status, Sub Status, and Source Network Address to identify password spraying, account lockouts, and source patterns.
What Event ID 4625 Tells You
Event ID 4625 is more than a generic failed login record. It shows that Windows rejected an attempted logon on the local system, and the surrounding fields help defenders distinguish a simple typo from deliberate password attacks or a wider authentication problem.
A single failure can be noise, but repeated 4625s across many accounts, hosts, or source addresses often indicate password spraying, brute force attempts, or misconfigured services. The value of the event is in correlation, not in the event alone.
Because the event is generated where the attempt occurred, it can appear on member servers, workstations, and domain controllers. That makes it useful for building a host-by-host view of where authentication pressure is landing and whether the failures are concentrated against one system or spread across the estate.
How to Read Logon Type, Status, and Source Pattern
The practical meaning of 4625 depends on the fields around it. Logon Type helps identify whether the attempt was interactive, remote, service-driven, or network-based. Status and Sub Status reveal why Windows rejected the attempt, while Source Network Address can expose a burst of failures from one host, subnet, or VPN exit point.
Analysts use those fields to separate user error from authentication abuse. For example, failures tied to a small number of usernames with many source IPs can fit password spraying, while repeated failures for one account may point to an application, scheduled task, or service using stale credentials.
The same event is also useful for spotting environmental issues that are not attacks at all, such as expired passwords, broken mapped drives, disconnected sessions, or service accounts that were not updated after a credential change.
Why Event ID 4625 Matters for Detection
4625 is one of the most important Windows events for early visibility into credential attacks because it captures the unsuccessful stage before a compromise becomes visible in later activity. When combined with successful logon events, it can show whether an attacker is testing credentials, probing lockout thresholds, or moving from guessing to access.
It is also a strong signal when correlated with account lockouts, unusual logon times, or remote logon patterns. The event becomes more useful when you compare it with neighbouring authentication records, because the pattern often matters more than the individual failure.
For broader Windows monitoring, it helps to understand how 4625 fits into the rest of the audit trail, including logon success, account use, and log clearing. NHIMG’s Windows Event Log Guide covers the event IDs and logging context that make 4625 easier to interpret.
Response and Triage for Failed Logons
When 4625 volume rises, defenders should treat the event as a starting point for triage rather than a conclusion. The key questions are whether the failures are concentrated, whether they target privileged or high-value accounts, and whether they come from a legitimate application, a human user, or an unknown source.
That review often benefits from adjacent authentication controls and detection tuning. A password-spraying pattern may require smarter lockout handling and rate limiting, while a service-account problem may call for credential review and application owner validation. NHIMG’s Password Spraying and Credential Stuffing Defence Guide is a useful companion when the failure pattern points to credential attack behaviour.
Where the same source also appears in other authentication or remote-access telemetry, defenders can gain more confidence about the pattern by comparing it with protocol-specific records. NHIMG’s Kerberos Security Guide helps when the failed logons are tied to Kerberos-based authentication paths and related failure events.
Risk and Threat Considerations
Repeated 4625 events are a security signal because they often precede account compromise, lockouts, or service disruption. Failed logons can reveal attack automation, validation of stolen usernames, or attempts to find weak passwords and exposed remote entry points.
Failure mechanism: Attackers or misconfigured services generate repeated authentication failures until they find a valid credential path, trigger a lockout condition, or hide inside noisy background traffic.
Impact: The result can be account disruption, credential exposure pressure, delayed detection of credential attacks, and a clearer path to successful access if the failures are not investigated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1110 — Brute Force | Failed logon patterns often indicate password guessing and spraying. |
| Recommendation — Map clustered 4625 failures to T1110 and hunt for spray timing, source reuse, and account targeting. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | 4625 is audit evidence that must be reviewed and correlated for suspicious access attempts. |
| IA-2 — Identification and Authentication (Organizational Users) | The event records rejected user authentication attempts on Windows systems. | |
| Recommendation — Review 4625 records under AU-6 to detect repeated failures, suspicious sources, and lockout patterns. Use IA-2 to validate authentication controls when 4625 shows repeated user logon failure. | ||
| CIS Controls v8 | CIS-5 — Account Management | Failed logons frequently expose account misuse, lockouts, and stale credentials. |
| CIS-8 — Audit Log Management | Event ID 4625 is a core audit log signal for authentication monitoring. | |
| Recommendation — Apply CIS-5 to govern accounts that generate repeated 4625 failures and remove obsolete access. Centralise 4625 collection under CIS-8 so failed logons are searchable and alertable. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Monitoring failed logons is a direct anomaly-detection use case for this event. |
| Recommendation — Use DE.CM-01 to baseline failed logon volume and alert on unusual 4625 spikes. | ||
Practitioner Guidance
Why practitioners should care: Event ID 4625 is most useful when it is treated as a pattern signal, not an isolated record. The event can expose password spraying, stale service credentials, or a user experience problem that is about to become an incident if no one investigates the source, account mix, and logon type.
What to watch for: Repeated failures against many accounts from the same source, repeated failures against one account across different sources, or failures that line up with lockouts and unusual remote access windows. Those patterns usually deserve faster attention than ordinary user mistakes.
Practitioner takeaway: The best 4625 analysis joins source, account, and logon context, then checks whether the failures fit attack behaviour, operational drift, or both.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org