> ## Documentation Index > Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt > Use this file to discover all available pages before exploring further. # How to See Failed Login Attempts on Windows Server (Event ID 4625) > Failed login attempts are event ID 4625 in the Windows Security log. Find them in Event Viewer or with Get-WinEvent and see source IPs and logon types. Failed login attempts on Windows Server are logged as **event ID 4625** ("An account failed to log on") in the **Security** log. Open **Event Viewer > Windows Logs > Security** and filter for `4625`, or run `Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50` in PowerShell as Administrator. Each event shows the account name, logon type and **Source Network Address** (the attacker's or user's IP). | Difficulty | Time | Works on | Needs | | - | - | - | - | | Beginner | 10 minutes | Windows Server 2019 / 2022 / 2025, Windows 10 / 11 | An administrator account | ## Before you start * Reading the Security log needs administrator rights. Open **PowerShell as Administrator** (right-click **Start** > **Terminal (Admin)**). * Event 4625 is written by the **Audit Logon** policy. Check that failure auditing is on: ```powershell theme={null} auditpol /get /subcategory:"Logon" ``` `Logon` should show `Success and Failure`. If it shows only `Success` or `No Auditing`, turn failure auditing on: ```powershell theme={null} auditpol /set /subcategory:"Logon" /success:enable /failure:enable ``` ## Which event IDs show logins? | Event ID | Meaning | Log | | - | - | - | | **4625** | An account failed to log on | Security | | **4624** | An account was successfully logged on | Security | | **4740** | A user account was locked out (needs **Audit User Account Management**) | Security | ## How to find failed logins in Event Viewer **1. Open Event Viewer** Press **Win+R**, type `eventvwr.msc` and press **Enter**. **2. Open the Security log** Expand **Windows Logs** and click **Security**. **3. Filter for 4625** In the right pane, click **Filter Current Log**, type `4625` in the event ID box (it shows **All Event IDs** until you type) and click **OK**. **4. Read an event** Click an event. The **General** tab shows **Account For Which Logon Failed > Account Name**, **Logon Type**, **Failure Information** and **Network Information > Source Network Address**. ## How to list failed logins with PowerShell The last 50 failures, newest first: ```powershell theme={null} Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 ``` Failures in the last 24 hours, with the useful fields pulled out of each event: ```powershell theme={null} $since = (Get-Date).AddDays(-1) Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$since} | ForEach-Object { $d = @{} ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' } [pscustomobject]@{ Time = $_.TimeCreated Account = $d.TargetUserName LogonType = $d.LogonType SourceIP = $d.IpAddress Status = $d.Status SubStatus = $d.SubStatus } } | Format-Table -AutoSize ``` Which IP addresses try most often: ```powershell theme={null} Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} | ForEach-Object { (([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text' } | Group-Object | Sort-Object Count -Descending | Select-Object -First 10 Count, Name ``` ```text theme={null} Count Name ----- ---- 1843 203.0.113.77 912 198.51.100.140 12 203.0.113.25 ``` `TargetUserName`, `LogonType`, `IpAddress`, `Status` and `SubStatus` are the field names Microsoft uses in the event's XML. ## How to read a 4625 event ### Logon type | Logon type | Name | Typical source | | - | - | - | | 2 | Interactive | Someone at the console (including the VNC console) | | 3 | Network | A user or computer logging on from the network | | 10 | RemoteInteractive | Remote Desktop (Terminal Services) | ### Status and Sub Status codes | Code | Meaning (Microsoft) | | - | - | | `0xC000006D` | Bad user name or authentication information | | `0xC000006A` | Correct user name, wrong password | | `0xC0000064` | User name does not exist | | `0xC0000072` | Account is disabled | | `0xC0000234` | Account is locked out | | `0xC000015B` | User has not been granted this logon type (for example not in **Remote Desktop Users**) | Many `0xC0000064` events for names like `admin`, `test` or `user` from one IP mean a bot is guessing user names. Many `0xC000006A` events against a real account mean someone is guessing its password. ## What to do if you see many failed logins **1. Make sure the passwords are strong** Change any weak password at once, starting with the Administrator account. **2. Limit who can reach RDP** Restrict the Remote Desktop firewall rules to your own IPs and set an account lockout policy. See [protect RDP from brute-force attacks](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md). **3. Check for successful logins you don't recognise** Look at 4624 events with logon type 10 from unknown IPs: ```powershell theme={null} Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 200 | Where-Object { (([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'LogonType').'#text' -eq '10' } ``` > [!WARNING] > > If you find a successful login you didn't make, treat the server as compromised: change all passwords from a clean computer, check for new user accounts and scheduled tasks, scan with [Microsoft Defender](https://help.freakhosting.com/portals/other/how-to-use-microsoft-defender-on-windows-server.md), and consider restoring from a known-good [backup](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md). ## Frequently asked questions ### Why is Source Network Address empty or "-"? Some failures don't carry an IP, for example local logons or some authentication paths. `::1` or `127.0.0.1` means the attempt came from the server itself. ### How long does Windows keep these events? Until the Security log reaches its maximum size, then the oldest events are overwritten. On a busy RDP server under attack this can be hours. Increase the size in **Event Viewer > Security > Properties > Maximum log size** if you need more history. ### Is a failed login always an attack? No. Saved passwords in an old RDP shortcut or a mapped drive often cause repeated failures from your own IP. Check the source IP before you block anything. ### Where do I see account lockouts? Event **4740** ("A user account was locked out") in the Security log. It needs the **Audit User Account Management** subcategory: `auditpol /get /subcategory:"User Account Management"`. ## Related guides > [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md) > > Every guide in this section. > [card] [Protect RDP from brute force](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md) > > Stop the attempts. > [card] [Windows Server security checklist](https://help.freakhosting.com/portals/other/windows-server-security-checklist.md) > > Every hardening step. > [card] [Use Microsoft Defender](https://help.freakhosting.com/portals/other/how-to-use-microsoft-defender-on-windows-server.md) > > Scan for malware. > [card] [PowerShell on Windows Server](https://help.freakhosting.com/portals/other/how-to-use-powershell-on-windows-server.md) > > Everyday commands. *** > [!NOTE] > > **Checked against Microsoft Learn: [Event 4625](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625), [Event 4740](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4740), [Audit Logon](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-logon), [auditpol set](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set) and [Get-WinEvent](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent)** on 4 November 2026. Commands were not tested on a live Windows server for this page; sample output is illustrative. > [!NOTE] > > ### Need Extra Help? > > If you encounter any issues, our support team is ready to assist: > > * **Live Chat:** Quick assistance via our website. > * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php) > * **Discord:** [Join our Community](https://discord.gg/freakhosting) > * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com) > [!TIP] > > ### Save on Your Hosting > > Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order! *** **Last Updated:** November 2026 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.