L,Event ID 4625 contains several fields useful for finding the source of,failure of authentication.
Steps.
- Open the event — Take Account Name, Logon Type, Status/Sub Status and Source Network Address.
- Identify the type of connection — Logon Type 3 often points to network access.
- Correlation — Search for 4740 if the account is locked.
- Treat source — Correct the password or application.
Commands
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 20Key takeaways
- Don’t mention the exact Status/Substatus.
- Avoid unlocking in a loop without finding the source.