Event ID 4625: what it means and how to stop the attacks

Event 4625 is Windows saying "An account failed to log on". One or two are a typo. Hundreds an hour, from addresses you don't know, are someone guessing passwords on your Server or PC.

1. Where to find Event 4625

Open Event Viewer (eventvwr.msc) › Windows Logs › Security › Filter Current Log › Event ID 4625. On a Server that is reachable from the internet you will often find thousands.

If there are none at all, failed logons may not be audited. They are switched on by default on current Windows versions, but a Group Policy can switch them off (Audit Logon, Failure).

A quick count in PowerShell (as administrator):

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} |
  Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

This groups the last 24 hours by source address (field 19 of the event), so the busiest attackers come first.

2. Reading the event

Status and Sub Status: why it failed

Code	Meaning	What it tells you
0xC000006A	Wrong password, user exists	The attacker has a real user name. Make sure that account has a strong password.
0xC0000064	User name does not exist	Typical of guessing: admin, user, test, scanner lists.
0xC000006D	Bad user name or password (generic)	Look at the Sub Status for the detail.
0xC0000234	Account locked out	Your lockout policy kicked in. This can lock out your own admins too.
0xC0000072	Account disabled	Someone tried a disabled account (e.g. the built-in Guest).
0xC000006F / 0xC0000070	Outside allowed hours / from a not-allowed workstation	An account restriction worked.
0xC0000071 / 0xC0000193	Password / account expired	Usually your own user, not an attack.
0xC000015B	Logon type not granted	The user may not log on this way (e.g. not allowed via RDP).

Logon Type: how they tried

Type	Meaning
3	Network: file shares, and also RDP with Network Level Authentication (NLA). Most RDP attacks show up as type 3, not 10.
10	Remote Interactive: RDP without NLA.
2	Interactive: at the keyboard of the machine.
8	Network cleartext: e.g. IIS basic authentication, OWA.
4 / 5	Batch / service: a scheduled task or service with a wrong or expired password.

Source Network Address: who

The attacker's IP address. With RDP it is sometimes empty (-). The address is then in a second log: Applications and Services Logs › Microsoft › Windows › RemoteDesktopServices-RdpCoreTS › Operational, Event ID 140 ("A connection from the client computer with an IP address of … failed because the user name or password is not correct").

3. Is it an attack, or just a typo?

• Probably harmless: a few events, your own user name, an address from your own network, at working hours.
• Attack: many events per hour; changing user names; internet addresses, often from several countries; Sub Status 0xC000006A / 0xC0000064; Logon Type 3 or 10 at night.
• Worth checking: Logon Type 4 or 5 repeating every few minutes is usually a task or service with an old password, not an attacker. Update the password, and the events stop.

4. How to stop it with Windows' own tools

1. Don't expose RDP to the whole internet. Remove the router's port forwarding for 3389, or put RDP behind a VPN or a Remote Desktop Gateway. This is the most effective step.
2. Limit who may connect: in Windows Defender Firewall, set the RDP rule's Remote IP address scope to the addresses you really use.
3. Keep Network Level Authentication on (System Properties › Remote › Allow connections only from computers running Remote Desktop with NLA).
4. Strong passwords and no obvious user names. Attackers try administrator first.
5. Account lockout policy (secpol.msc › Account Lockout Policy): it slows guessing down, but an attacker can also lock out your real admin. Use it with care, and never as the only measure.

What Windows does not do by itself: block the attacking IP address. Every guess still reaches your Server, and the attacker simply keeps trying.

5. Stop it for good: Coinetic blocks the attackers for you

Doing it by hand means: reading thousands of 4625 events, looking up addresses, adding them to a firewall rule, and doing it again tomorrow, because the attacks run day and night from new addresses. Lockout policies can lock out your own admins, and nobody tells you when it gets serious.

Coinetic does all of this by itself, on every Windows Server and PC:

• Attackers are banned automatically: after the number of failed logins you choose, the address is blocked by a Windows Firewall rule and cannot even reach your login screen again.
• Nothing to read by hand: Coinetic reads Event 4625 and the RDP Event 140 for you and shows every failed login with address, country, user name and what it did (counted 1 of 5, auto-banned, already banned).
• Your own people are never locked out: addresses from your own network and whitelisted addresses are shown, but never banned.
• Works on any Windows language, because events are read by number and fields, not by translated text.
• More than RDP (Pro): VPN, SQL Server, MySQL, PostgreSQL, Exchange, hMailServer, OpenSSH, VNC and FTP.
• Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “Who is 203.0.113.228 and why was it banned?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

Even better: make RDP invisible to attackers

Bans stop attackers after a few tries. Device approval stops them before the first one. Your RDP port is closed to the internet, so scanners and password guessers find nothing at all. When you need access:

1. Register your phone once in Coinetic (scan a QR code).
2. Tap Unlock on your phone and confirm with your fingerprint, face or PIN.
3. Coinetic opens RDP only for your phone's current internet address, for the hours you chose (8 by default), then closes it again by itself.

No VPN to set up or maintain. Your own network and VPN always work. The unlock is signed by your phone's passkey and checked by Coinetic on your Server, so nobody else can open the port. How Device approval works in detail.

More guides: all Coinetic guides.

Frequently asked

Can I just ignore Event 4625?

A few, yes. A steady stream from the internet means your login is being attacked. Sooner or later a weak or reused password is found.

Why do I see Logon Type 3 for RDP attacks?

With Network Level Authentication, the password is checked before the remote desktop session starts, so Windows records it as a network logon (type 3).

The Source Network Address is empty. How do I find the attacker?

Look at Event 140 in the RemoteDesktopServices-RdpCoreTS Operational log at the same time. It contains the client's IP address.

Does an account lockout policy stop the attack?

It stops one account from being guessed, but the attack goes on against other names, and it can lock out your own administrators. Blocking the attacking address is the better fix.