event id 4625

Event ID 4625 is a Windows Security log event that records failed sign-in attempts. On Windows 10 and Windows 11, this event can help identify forgotten passwords, misconfigured services, Remote Desktop probing, or potential break-in attempts. To capture event ID 4625, you must enable the appropriate audit policy for logon events. Once enabled, failed logon attempts are logged in the Security event log and can be reviewed using Event Viewer. This tag covers tutorials on enabling audit policies, testing failed logon auditing, and interpreting event ID 4625 entries. It is relevant for users managing security auditing on Windows 10 and Windows 11, including Home editions and domain-joined PCs.