Did You Know: The Status Code in Windows Event 4625 Separates a Bad Password From an Account That Does Not Exist

LONDON - A spike in failed Windows logons is one of the first things a SOC looks at when it suspects password guessing, but the count alone says little. Microsoft documents Event 4625, An account failed to log on, as the event logged for any logon failure. It is generated on the computer where the logon attempt was made, so a failed attempt at a user's workstation is logged on that workstation, and it appears on domain controllers, member servers and workstations. The event belongs to the Audit Logon and Audit Account Lockout subcategories, and Microsoft says Audit Logon failure events show failed logon attempts and the reason why these attempts failed.

That reason sits in the Failure Information block. Failure Reason is a textual explanation of the Status field value. Status is the reason why the logon failed, and Sub Status gives additional information about the failure; Microsoft points readers to its NTSTATUS Values reference for the meaning of each code. In that reference, 0xC000006D is STATUS_LOGON_FAILURE, which Microsoft describes as an invalid logon that is either due to a bad username or authentication information. On its own, that value does not say which of the two it was.

Microsoft's security monitoring recommendations for 4625 list the values to watch in either the Status or the Sub Status field. 0xC0000064 is a user logon with a misspelled or bad user account, and Microsoft says that several of these in a row can be a sign of a user enumeration attack. 0xC000006A is a logon with a misspelled or bad password; Microsoft says to watch for it on critical accounts and service accounts, especially a number of such events in a row, and gives the same advice for 0xC000006D. The table also lists 0xC000006F for a logon outside authorized hours, 0xC0000070 for a logon from an unauthorized workstation, 0xC0000072 for an account disabled by an administrator, 0xC0000193 for an expired account and 0xC000015B for a user who has not been granted the requested logon type. Two entries cut the other way: 0xC000005E, no logon servers available, and 0xC0000192, the Netlogon service not started, are described as typically not a security issue but an infrastructure or availability issue. Microsoft's field descriptions use a lockout as the worked example, with a Failure Reason of Account locked out and a Status of 0xC0000234, which the NTSTATUS reference names STATUS_ACCOUNT_LOCKED_OUT.

Domain accounts add a second place to look. Event 4776 is logged every time a credential validation occurs using NTLM authentication, only on the computer that is authoritative for the credentials, which for domain accounts is the domain controller. Its Error Code table carries matching values, including 0xC0000064, 0xC000006A, 0xC000006D and 0xC0000234. Kerberos failures surface in Event 4771, which is generated only on domain controllers when the Key Distribution Center fails to issue a ticket granting ticket. Microsoft lists failure code 0x18, KDC_ERR_PREAUTH_FAILED, as the wrong password being provided, and says a run of these events in a short period can indicate a brute force attack on the account password, especially for highly critical accounts.

For a detection engineer, the practical step is to group failed logons by code as well as by account and source. A burst of 0xC0000064 is a different finding from a burst of 0xC000006A against one service account, and both differ from a run of 0xC000005E during a domain controller outage. Microsoft also suggests checking the Logon Type in the same event for a mismatch with the account using it, and comparing the Source Network Address with the list of addresses an account is expected to use. Rules that alert on every 4625 at the same weight will page analysts for outages and bury the codes Microsoft flags as signs of an attack.