SubStatus Codes

The substatus codes for Event ID 4625 provide specific reasons for failed logon attempts in Windows environments. These codes are crucial for diagnosing logon issues, identifying potential security threats, and understanding the context of authentication failures. Below is a detailed overview of common substatus codes associated with Event ID 4625, offering insights into what each code signifies.

Common Substatus Codes for Event ID 4625

• 0xC0000064: User name does not exist. Indicates that the username provided for the logon attempt is not recognized by the system.

• 0xC000006A: User name is correct, but the password is wrong. Signifies that the password entered for the account is incorrect.

• 0xC000006D: This is a generic status code indicating a logon attempt failure, usually accompanied by a more specific substatus code.

• 0xC000006E: User account restriction. Reasons for restriction can include time of day, logon hours, or a policy restriction has been enforced.

• 0xC000006F: User logon outside authorized hours. Indicates an attempt to log on outside of the user's permitted time frame.

• 0xC0000070: User not allowed to logon at this computer. Signifies that the user's account is not permitted to log on from the current workstation.

• 0xC0000071: Password expired. The user's password has expired and must be changed.

• 0xC0000072: Account disabled. The account being accessed has been disabled and cannot be used for logon.

• 0xC000009A: Insufficient system resources. Indicates that the system failed to log on the user due to a lack of system resources.

• 0xC0000193: Account expiration. The account has expired according to the account's expiration date set in the directory.

• 0xC0000224: User is required to change their password at next logon. This often requires interactive logon and cannot be done over network logon types.

• 0xC0000225: Evidently a bug in Windows and not a documented status code; often appears with or similar to 0xC000006D/0xC0000064.

• 0xC0000234: User account locked out. The account has had too many failed logon attempts and has been locked out.

• 0xC00002EE: Failure due to error in Kerberos authentication. A specific case usually related to Kerberos authentication failures.