Event Details
Operating System->Microsoft Windows->Built-in logs->Windows 2008 or higher->Security Log->Logon/Logoff->Account Lockout->EventID 4625 - An account failed to log on.
EventID 4625 - An account failed to log on.
Indicates that a user failed to log on due to any reason.

Note:
  • This event is logged on the workstation or server where the user failed to log on.
    Logon type field allows to determine if user attempted to log on locally or remotely.
  • Since Windows 2008 all failed logons for any reason were put together into EventID 4625. 
For explanation of the values of some fields please refer to the corresponding links below:

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:


Windows 2000
Windows 2003
 Sample:
An account failed to log on.
Subject:
	Security ID:		S-1-5-21-1135140816-2109348461-2107143693-500
	Account Name:		ALebovsky
	Account Domain:		LOGISTICS
	Logon ID:		0x2a88a
Logon Type:			2
Account For Which Logon Failed:
	Security ID:		S-1-0-0
	Account Name:		Paul
	Account Domain:		LOGISTICS
Failure Information:
	Failure Reason:		Account locked out.
	Status:			0xc0000234
	Sub Status:		0x0
Process Information:
	Caller Process ID:	0x3f8
	Caller Process Name:	C:\Windows\System32\svchost.exe
Network Information:
	Workstation Name:	DCC1
	Source Network Address:	::1
	Source Port:		0
Detailed Authentication Information:
	Logon Process:		seclogo
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
===========================
Description template stored in adtschema.dll:
===========================
An account failed to log on.

Subject:
	Security ID:		%1
	Account Name:		%2
	Account Domain:		%3
	Logon ID:		%4

Logon Type:			%11

Account For Which Logon Failed:
	Security ID:		%5
	Account Name:		%6
	Account Domain:		%7

Failure Information:
	Failure Reason:		%9
	Status:			%8
	Sub Status:		%10

Process Information:
	Caller Process ID:	%18
	Caller Process Name:	%19

Network Information:
	Workstation Name:	%14
	Source Network Address:	%20
	Source Port:		%21

Detailed Authentication Information:
	Logon Process:		%12
	Authentication Package:	%13
	Transited Services:	%15
	Package Name (NTLM only):	%16
	Key Length:		%17
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows Vista (2008)
Windows 7 (2008 R2)
Windows 8 (2012)
Windows 8.1 (2012 R2)
Windows 10 (2016)
Category Logon/Logoff
Source Microsoft-Windows-Security-Auditing
TaskCategory Account Lockout
EventId 4625
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Task Category A name for a subclass of events within the same Event Source. TaskCategory
Level Warning, Information, Error, etc. Level
Keywords Audit Success, Audit Failure, Classic, Connection etc. Keywords
Category A name for an aggergative event class, corresponding to the similar ones present in Windows 2003 version. Category Account Logon
Object Name -
Whom -
Object Type -
Class Name -
Security ID -
Account Name -
Account Domain -
Subject: Security ID InsertionString1 S-1-5-21-1135140816-2109348461-2107143693-500
Subject: Account Name InsertionString2 ALebovsky
Subject: Account Domain InsertionString3 LOGISTICS
Subject: Logon ID InsertionString4 0x2a88a
Account For Which Logon Failed: Security ID InsertionString5 S-1-0-0
Account For Which Logon Failed: Account Name InsertionString6 Paul
Account For Which Logon Failed: Account Domain InsertionString7 LOGISTICS
Failure Information: Failure Reason InsertionString9 Account locked out.
Failure Information: Status InsertionString8 0xc0000234
Failure Information: Sub Status InsertionString10 0x0
Process Information: Caller Process ID InsertionString18 0x3f8
Process Information: Caller Process Name InsertionString19 C:\Windows\System32\svchost.exe
Network Information: Workstation Name InsertionString14 DCC1
Network Information: Source Network Address InsertionString20 ::1
Network Information: Source Port InsertionString21 0
Detailed Authentication Information: Logon Process InsertionString12 seclogo
Detailed Authentication Information: Authentication Package InsertionString13 Negotiate
Detailed Authentication Information: Transited Services InsertionString15 -
Detailed Authentication Information: Package Name (NTLM only) InsertionString16 -
Detailed Authentication Information: Key Length InsertionString17 0
Comments
You must be logged in to comment