4625, or run Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 in PowerShell as Administrator. Each event shows the account name, logon type and Source Network Address (the attacker’s or user’s IP).
Before you start
- Reading the Security log needs administrator rights. Open PowerShell as Administrator (right-click Start > Terminal (Admin)).
- Event 4625 is written by the Audit Logon policy. Check that failure auditing is on:
Logon should show Success and Failure. If it shows only Success or No Auditing, turn failure auditing on:
Which event IDs show logins?
How to find failed logins in Event Viewer
1
Open Event Viewer
Press Win+R, type
eventvwr.msc and press Enter.2
Open the Security log
Expand Windows Logs and click Security.
3
Filter for 4625
In the right pane, click Filter Current Log, type
4625 in the event ID box (it shows All Event IDs until you type) and click OK.4
Read an event
Click an event. The General tab shows Account For Which Logon Failed > Account Name, Logon Type, Failure Information and Network Information > Source Network Address.
How to list failed logins with PowerShell
The last 50 failures, newest first:TargetUserName, LogonType, IpAddress, Status and SubStatus are the field names Microsoft uses in the event’s XML.
How to read a 4625 event
Logon type
Status and Sub Status codes
Many
0xC0000064 events for names like admin, test or user from one IP mean a bot is guessing user names. Many 0xC000006A events against a real account mean someone is guessing its password.
What to do if you see many failed logins
1
Make sure the passwords are strong
Change any weak password at once, starting with the Administrator account.
2
Limit who can reach RDP
Restrict the Remote Desktop firewall rules to your own IPs and set an account lockout policy. See protect RDP from brute-force attacks.
3
Check for successful logins you don't recognise
Look at 4624 events with logon type 10 from unknown IPs:
Frequently asked questions
Why is Source Network Address empty or ”-”?
Some failures don’t carry an IP, for example local logons or some authentication paths.::1 or 127.0.0.1 means the attempt came from the server itself.
How long does Windows keep these events?
Until the Security log reaches its maximum size, then the oldest events are overwritten. On a busy RDP server under attack this can be hours. Increase the size in Event Viewer > Security > Properties > Maximum log size if you need more history.Is a failed login always an attack?
No. Saved passwords in an old RDP shortcut or a mapped drive often cause repeated failures from your own IP. Check the source IP before you block anything.Where do I see account lockouts?
Event 4740 (“A user account was locked out”) in the Security log. It needs the Audit User Account Management subcategory:auditpol /get /subcategory:"User Account Management".
Related guides
VPS and dedicated server guides
Every guide in this section.
Protect RDP from brute force
Stop the attempts.
Windows Server security checklist
Every hardening step.
Use Microsoft Defender
Scan for malware.
PowerShell on Windows Server
Everyday commands.
Checked against Microsoft Learn: Event 4625, Event 4740, Audit Logon, auditpol set and Get-WinEvent on 4 November 2026. Commands were not tested on a live Windows server for this page; sample output is illustrative.
Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026