How to find the source of failed login attempts

Steps to enable logon failure auditing using group policy:

The simplest way to view logged in users is by using the query user command.

1. Open the Group Policy Management Console (GPMC) or run the command gpmc.msc.
2. If you want to audit all the accounts in the domain, right-click the domain name and click Create a GPO in this domain, and Link it here. If you want to audit accounts in a specific organizational unit (OU), right-click the OU and click Create a GPO in this domain, and Link it here.
3. Provide a relevant name for the GPO, right-click it, choose Edit, and navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff > Audit Logon. In the Audit Logon Properties window, select the Failure check box (selecting Success is optional), and click OK.

   

4. Go back to the GPMC, right-click the OU or domain in which the GPO was linked, and click Group Policy Update. This step makes sure the new Group Policy settings are applied instantly instead of waiting for the next scheduled refresh.

Once the above steps are complete, logon failure events will be recorded as event logs, and they can be viewed in the Event Viewer by following the steps below.

Steps to find the source of failed login attempts in Windows Event Viewer:

1. Open the Event Viewer. On the left pane, navigate to Windows log > Security.
2. On the right pane, navigate to Security > Filter current log.
3. In the pop-up window, enter the 4625 in the field labeled . This will provide you with a list of occurrences of Event ID 4625. Double-click the Event ID to view its properties.

Important information that can be derived from Event ID 4625 includes:

• Account Name: Name of the user.
• Failure Reason: Why the failure occurred, such as a bad password.
• Logon Typ: How access was attempted.
• Workstation Name: NetBIOS name of the the computer.
• Source Network Address: IP address of the computer.

Workstation Name and Source Network Address together help identify where the failed attempt came from.



Logon types you’ll see most:

Code	Meaning	Typical scenario
2	Interactive	Local console sign-in
3	Network	Access over the network (e.g., SMB, mapped drives)
7	Unlock	Workstation unlock
10	RemoteInteractive	RDP/Remote Desktop sign-in
11	CachedInteractive	Cached domain logon (e.g., laptops)

View more