IT Toolbox
Guide

How to analyze an Event ID 4625

L,Event ID 4625 contains several fields useful for finding the source of,failure of authentication.

TopicCybersecurity →
⌚ About 2 min read
View my favorites
Windows & Security Intermediate. 15 min.

L,Event ID 4625 contains several fields useful for finding the source of,failure of authentication.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Open the event

    Take Account Name, Logon Type, Status/Sub Status and Source Network Address.

  2. 2

    Identify the type of connection

    A Logon Type 3 often points to network access.

  3. 3

    Correlation

    Look for 4740 if the account is locked.

  4. 4

    Treat source

    Correct the saved password or the relevant application.

Commands utiles

The new version of the document is available on the website of the European Commission.

À retenir

  • Don't mention the exact Status/Substatus.
  • Avoid unlocking in a loop without finding the source.
← All les guides
Technical deep dive

AD authentication: correlate code, DC and account

Technical checkpoints

  • Event ID 4625 contains Status/SubStatus values that distinguish bad password, disabled account, restrictions and other causes.
  • Lockout is logged as 4740 on the DC handling it; Caller Computer Name helps locate the offending host/service.
  • A gMSA depends on the KDS root key, hosts allowed to retrieve its password, SPNs and time/Kerberos.

Correlation

Find the event at the exact time and correlate user, source, LogonType and SubStatus.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
Get-ADUser user -Properties LockedOut,LastBadPasswordAttempt

Topic-specific pitfalls

  • Unlocking the account without removing the bad-password source causes another lockout.
  • A service, scheduled task, phone or mapped drive can keep using an old secret.

How to validate

  • The failure source is identified and 4625/4740 events stop after remediation.
  • The account/gMSA authenticates from the actually affected system.
♡ 0