Event ID: 4625 Source: Microsoft-Windows-Security-Auditing

Event ID/Source search

Keyword search

Example: Windows cannot unload your registry file

EvLog 2.0 - Free event log analyzer for subscribers

EvLog2 sample report

Advanced filtering

Direct links to www.eventid.net

Email notifications

Scheduled reporting

Analyze 50 servers or your home PC!

Event ID: 4625 Source: Microsoft-Windows-Security-Auditing

Source: Microsoft-Windows-Security-Auditing

Type: Failure Audit

Description:
An account failed to log on.

Subject:
       Security ID: S-1-0-0
       Account Name: <account name>
       Account Domain: <domain>
       Logon ID: 0x0
Logon Type: <type>
Account For Which Logon Failed:
       Security ID: S-1-0-0
       Account Name: <account name>
       Account Domain: <domain>
Failure Information:
       Failure Reason: Unknown user name or bad password.
       Status: 0xc000006d
       Sub Status: 0xc0000064
Process Information:
       Caller Process ID:       0x0
       Caller Process Name:       -
Network Information:
       Workstation Name: <workstation name>
       Source Network Address: <IP address>
       Source Port: <port>
Detailed Authentication Information:
       Logon Process:              NtLmSsp
       Authentication Package:       NTLM
       Transited Services:       -
       Package Name (NTLM only):       -
       Key Length:              0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
       - Transited services indicate which intermediate services have participated in this logon request.
       - Package name indicates which sub-protocol was used among the NTLM protocols.
       - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

English: Request a translation of the event description in plain English.

Comments:
EventID.Net
If the event description does not contain the user account name, it might be due to a bug in the way Windows handles the use of a smart card to log on to a domain. See ME2157973 for information about a hotfix.
Click if the comment is good!

^{x
9}

Anonymous
In my case, one host is available from network under few names. It's a web server (Windows 2008, MOSS2007). ME896861 helped (method 1).
Click if the comment is good!

^{x
9}

W. Rogers
See additional information about this event by following the link to "Windows Security Log Event ID 4625".
Click if the comment is good!

^{x
38}

Michael Nürnberger
I get this error after the installation from IE8RC1 on a W8k Server. Botht the problem and the solution are similar with the ones described in ME896861.
Click if the comment is good!

^{x
9}

EventID.Net
See ME957713 for information about this event.
Click if the comment is good!

^{x
12}

Private comment: Subscribers only. See example of private comment

Links: Windows Security Log Event ID 4625

Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue - More links...

Feedback: Send comments or solutions - Notify me when updated

Printer friendly