thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Event ID 4625

The Windows Security event recorded when an account fails to log on.

Definition

Event 4625 includes the account name, logon type, failure reason and source address, with status codes such as 0xC000006A (bad password) and 0xC0000064 (unknown user). Spikes indicate brute force or password spraying.

Example

Hundreds of 4625 events for different usernames from one IP within minutes.

Exam tip

Many 4625s across many accounts from one source = password spraying.

Related terms