Windows 10: Event ID 4625

Dangel17 · Apr 16, 2022

Hi, Can some help me. I looked for possible solution and locate the root caused but unfortunately still having a lot of failed login. Thanks in advanced.- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4625</EventID> <Version>0</Version> <Level>0</Level> <Task>12544</Task> <Opcode>0</Opcode> <Keywords>0x8010000000000000</K

:)

Anto K O · Apr 16, 2022

Event 4625

event id 4625 not been logged in servers (server 2012 r2 standard) when the failed logon attempt via rdp.

Prakhar_Khare · Apr 16, 2022

Event 4625 keeps happening every day at (nearly) the same time

Hi,

Thank you for writing to Microsoft Community Forums.

I understand that you are getting the Event ID 4625 on your PC at a specific time.

I have been researching on this and found some information which might be helpful for you. You can refer the article

4625(F): An account failed to log on

However, as you have mentioned that the Event ID is getting triggered at a particular time there are possibilities that a task is being executed at that time interval. I would suggest you to check the task scheduler and see if any task is executed
at that time.

Press Windows + S key together and type
Task Scheduler.

Now on the left hand pane click on Task Scheduler (local).

Now under Task Status select the drop down for
Last 24 hours/Last hour and check if any task is executing at
1 PM.

Please get back to us with the detailed information to assist you further.

We await your response.

Regards,

Prakhar Khare

Microsoft Community – Moderator

GM1997_601 · Apr 16, 2022

Mysterious event IDs 4723 and 4625

Every time I login into my personal computer, I see an event ID 4723 with a timestamp of few minutes after logging in.

For example, I logged in at 6:01 PM and saw the event logged at 6:03 PM.

The event is as follows:

An attempt was made to change an account's password.
Subject:
Security ID: SYSTEM
Account Name: MyDesktop$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Target Account:
Security ID: MyDesktop\DefaultAccount
Account Name: DefaultAccount
Account Domain: MyDesktop

Additional Information:
Privileges -
Click to expand...

I have not made any changes to any passwords. This is followed by an audit failure event 4625. This happens a couple times every time I log in and then stops.

An account failed to log on.

Subject:
Security ID: SYSTEM
Account Name: MyDesktop$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Type: 2

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: DefaultAccount
Account Domain: MyDesktop

Failure Information:
Failure Reason: Account currently disabled.
Status: 0xC000006E
Sub Status: 0xC0000072

Process Information:
Caller Process ID: 0x190
Caller Process Name: C:\Windows\System32\lsass.exe

Network Information:
Workstation Name: MyDesktop
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
Click to expand...

Can any one help me figure out what is going on? Thank you

Windows 10: Event ID 4625

Event ID 4625

Event ID 4625

Event ID 4625

Event ID 4625 - Similar Threads - Event 4625

Event 4625, Audit Failure Microsoft Windows Security Auditing

Event 4625, Audit Failure Microsoft Windows Security Auditing

Event 4625, Audit Failure Microsoft Windows Security Auditing

Event ID 4625 in domain controller account.

Event ID 4625 in domain controller account.

Weird "account" in Event ID 4625 - Security Log

Weird "account" in Event ID 4625 - Security Log

Event ID: 4625 Thrown while using IADs::Get method

Event ID: 4625 Thrown while using IADs::Get method