Windows event log · Security4625 Failed logon

Security
7 fields
Security.evtx
Microsoft-Windows-Security-Auditing

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

UserName%domain%\%user%
- %domain% = /Event/EventData/Data[@Name="SubjectDomainName"]
- %user% = /Event/EventData/Data[@Name="SubjectUserName"]
RemoteHost%workstation% (%ipAddress%)
- %ipAddress% = /Event/EventData/Data[@Name="IpAddress"]
- %workstation% = /Event/EventData/Data[@Name="WorkstationName"]
PayloadData1Target: %TargetDomainName%\%TargetUserName%
- %TargetDomainName% = /Event/EventData/Data[@Name="TargetDomainName"]
- %TargetUserName% = /Event/EventData/Data[@Name="TargetUserName"]
PayloadData2LogonType %LogonType%
- %LogonType% = /Event/EventData/Data[@Name="LogonType"]
ExecutableInfo%ProcessName%
- %ProcessName% = /Event/EventData/Data[@Name="ProcessName"]
PayloadData3FailureReason1: %Status%
- %Status% = /Event/EventData/Data[@Name="Status"]
PayloadData4FailureReason2: %SubStatus%
- %SubStatus% = /Event/EventData/Data[@Name="SubStatus"]

Value lookups

Codes that EvtxECmd turns into text

Status

0xC000005E: there are currently no logon servers available to service the logon request
0xC0000064: user name does not exist
0xC000006A: user name is correct but the password is wrong
0xC000006D: the cause is either a bad username or authentication information
0xC000006E: referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
0xC000006F: user logon outside authorized hours
0xC0000070: user logon from unauthorized workstation
0xC0000071: user logon with expired password
0xC0000072: user logon to account disabled by administrator
0xC00000DC: indicates the Sam Server was in the wrong state to perform the desired operation
0xC0000133: clocks between DC and other computer too far out of sync
0xC000015B: the user has not been granted the requested logon type (also called the logon right) at this machine
0xC000018C: the logon request failed because the trust relationship between the primary domain and the trusted domain failed
0xC0000192: an attempt was made to logon, but the Netlogon service was not started.
0xC0000193: user logon with expired account
0xC0000224: user is required to change password at next logon
0xC0000225: evidently a bug in Windows and not a risk
0xC0000234: user is currently locked out
0xC00002EE: an error occurred during logon
0xC0000413: logon failure , the machine you are logging on to is protected by an authentication firewall, the specified account is not allowed to authenticate to the machine
0x0: Status OK

SubStatus

0xC000005E: there are currently no logon servers available to service the logon request
0xC0000064: user name does not exist
0xC000006A: user name is correct but the password is wrong
0xC000006D: the cause is either a bad username or authentication information
0xC000006E: referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
0xC000006F: user logon outside authorized hours
0xC0000070: user logon from unauthorized workstation
0xC0000071: user logon with expired password
0xC0000072: user logon to account disabled by administrator
0xC00000DC: indicates the Sam Server was in the wrong state to perform the desired operation
0xC0000133: clocks between DC and other computer too far out of sync
0xC000015B: the user has not been granted the requested logon type (also called the logon right) at this machine
0xC000018C: the logon request failed because the trust relationship between the primary domain and the trusted domain failed
0xC0000192: an attempt was made to logon, but the Netlogon service was not started.
0xC0000193: user logon with expired account
0xC0000224: user is required to change password at next logon
0xC0000225: evidently a bug in Windows and not a risk
0xC0000234: user is currently locked out
0xC00002EE: an error occurred during logon
0xC0000413: logon failure , the machine you are logging on to is protected by an authentication firewall, the specified account is not allowed to authenticate to the machine
0x0: N/A

Sample event

Event XML from the map file

<EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data>
  <Data Name="SubjectUserName">BASE-RD-01$</Data>
  <Data Name="SubjectDomainName">shieldbase</Data>
  <Data Name="SubjectLogonId">0x3E7</Data>
  <Data Name="TargetUserSid">S-1-0-0</Data>
  <Data Name="TargetUserName">-</Data>
  <Data Name="TargetDomainName">-</Data>
  <Data Name="Status">0xC0000073</Data>
  <Data Name="FailureReason">%%2304</Data>
  <Data Name="SubStatus">0xC0000073</Data>
  <Data Name="LogonType">5</Data>
  <Data Name="LogonProcessName">Advapi</Data>
  <Data Name="AuthenticationPackageName">Negotiate</Data>
  <Data Name="WorkstationName">-</Data>
  <Data Name="TransmittedServices">-</Data>
  <Data Name="LmPackageName">-</Data>
  <Data Name="KeyLength">0</Data>
  <Data Name="ProcessId">0x3E8</Data>
  <Data Name="ProcessName">C:\Windows\System32\svchost.exe</Data>
  <Data Name="IpAddress">-</Data>
  <Data Name="IpPort">-</Data>
</EventData>

References

10 links

Parse it

Extract this event from Security.evtx

EvtxECmd

EvtxECmd.exe -f "C:\Windows\System32\winevt\Logs\Security.evtx" --inc 4625 --csv "D:\Parsed"

KAPE module

kape.exe --msource D:\Evidence --mdest D:\Parsed --module EvtxECmd

Collect the log

C:\Windows\System32\winevt\Logs\Security.evtx

EventLogs

Source: evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4625.map(opens in new tab) by Eric Zimmerman and Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)