An account failed to log on

What it means

A sign-in failed. The Status and Sub Status codes explain why: 0xC000006A wrong password, 0xC0000064 the user name doesn’t exist, 0xC0000072 account disabled, 0xC0000193 account expired, 0xC000006F outside allowed hours.

Why it matters

A burst of failures against many accounts is a password-spray attack; many 0xC0000064 failures suggest someone is guessing user names.

What to do

• Group failures by Source Network Address and Account Name.
• Block or investigate external IPs with repeated failures.
• For a single user, look for a device with an old saved password.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4625
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.

Step-by-step guide

Find the source of Active Directory account lockouts