If you think someone has tried to sign in to your Windows PC, you don't have to guess. Windows keeps security events that can show failed logon attempts, including when they happened, which account was targeted, the type of logon, and, when available, where the request came from.
The key event to look for is Event ID 4625. Microsoft defines this as an event generated when an account fails to log on.
The useful part isn't just finding "4625." I'll show you how to filter these events, understand the important fields, check failed logins with PowerShell, and figure out whether a strange login was actually suspicious or just Windows being Windows.
What Is a Failed Login Attempt?
A failed login attempt simply means Windows received a request to sign in to an account, but the sign-in didn't succeed.
That could happen because someone entered the wrong password. But it could also come from a saved password, a network connection, a service, a scheduled task, or another device trying to use old credentials.
So don't see one failed login and immediately assume someone is hacking your PC. One event is a clue, not a verdict.
Windows records failed logon events under the Security log when the appropriate auditing is enabled. Event ID 4625 is the main event to look for when checking failed logons.
Check Event Viewer First
The easiest way to find failed login attempts is through Event Viewer.
You don't need to install anything. Windows already has it.
Open Security Logs
Follow these steps:
- Press Windows + R.
- Type
eventvwr.msc. - Press Enter.
- Expand Windows Logs.
- Click Security.
You'll see a long list of security events.
And yes, it can look like a wall of numbers at first. Don't worry—we only need one important number.
Filter for Event ID 4625
Instead of scrolling through thousands of events, filter the log.
- Right-click Security.
- Click Filter Current Log...
- In the <All Event IDs> box, type
4625. - Click OK.
Event Viewer will now show failed logon events that match Event ID 4625.
That's much better than hunting through the Security log like you're looking for a needle in a haystack.
Also Read: How to Check Your Wi-Fi Signal Strength in dBm
Open a 4625 Event
Click one of the results. You'll normally see information such as:
- Log Name
- Source
- Date and Time
- Event ID
- Task Category
- Keywords
- User
- Computer
- Description
The description is where things get interesting.
A failed logon event normally starts with:
An account failed to log on.
The event can contain information about the account involved, the logon type, the reason for failure, process information, and network information.
The Important Fields
Don't try to understand every line in the event. Most people don't need to.
Focus on these fields.
Account Name
This tells you which account the failed logon was trying to use.
For example:
Account Name: Administrator
or:
Account Name: John
If you don't recognize the account, that's worth investigating.
But an unfamiliar account name doesn't automatically mean an attacker. Windows services, old settings, mapped network drives, and other software can sometimes generate failed authentication attempts.
Logon Type
This one is extremely useful.
The Logon Type tells you what kind of sign-in Windows was dealing with.
| Logon Type | Meaning |
|---|---|
| 2 | Interactive sign-in, such as sitting at the PC |
| 3 | Network logon |
| 4 | Batch job |
| 5 | Windows service |
| 7 | Unlocking the computer |
| 8 | Network logon using a specific type of network authentication |
| 10 | Remote Desktop |
| 11 | Cached interactive logon |
The most useful ones for basic troubleshooting are 2, 3, 5, 7, and 10.
For example, if you're sitting at your PC and accidentally type the wrong password, a Logon Type 2 event can make sense.
If you see Logon Type 10, that's related to Remote Desktop.
A Logon Type 3 means a network logon was attempted. That doesn't automatically mean someone on the internet tried to break in. A device or service on your local network can also create this kind of event.
Also Read: How to Check Which Drivers Were Recently Updated in Windows
Check the Failure Reason
Next, look at Failure Information.
You'll usually see fields such as:
- Failure Reason
- Status
- Sub Status
A common message is: Unknown user name or bad password.
That's pretty straightforward.
But the status and sub-status codes can give you more detail when the reason isn't obvious.
For example, you may see a code such as:
0xC000006D
Don't panic when you see a code like this. It's simply a Windows status value that helps explain why authentication failed.
If you want to investigate a repeated event, copy the status and sub-status values and check the exact values against reliable Microsoft documentation.
Check the Source Network Address
This is one of the most interesting parts of Event 4625.
Look under Network Information. You may see:
- Workstation Name
- Source Network Address
- Source Port
If a failed network logon came from another device, Windows may record the source network address.
For example:
| Field | Example |
|---|---|
| Source Network Address | 192.168.1.25 |
| Source Port | 54821 |
| Workstation Name | DESKTOP-PC |
That address could belong to another device on your home network.
If you see an address you don't recognize, don't immediately assume it's an attacker. First check what device is using that address. Your router's connected-device list can help here.
Check the Caller Process
Sometimes the event contains Process Information. You'll see fields such as:
- Caller Process ID
- Caller Process Name
For example, you might see:
C:\Windows\System32\services.exe
or:
C:\Windows\System32\winlogon.exe
This can be very helpful when a failed login keeps happening even though nobody is trying to sign in manually.
A Windows service, scheduled task, or application may be trying to authenticate with an old password.
Check Several Events, Not Just One
This is where you can avoid a lot of unnecessary panic.
Suppose you find one failed login from yesterday. That alone doesn't tell you much.
Now suppose you find several failed attempts spread across several days. That's still not necessarily an attack.
But imagine you find:
- 50 failed attempts
- The same account
- The same source address
- Attempts every few seconds
- Mostly network or Remote Desktop logons
Now you've got something that deserves a much closer look.
The pattern matters more than a single event.
Use PowerShell to Find 4625 Events
Event Viewer is great for manually checking logs.
But if you want a faster way to search them, PowerShell is your friend.
Open Windows Terminal or PowerShell and run:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
This searches the Security log for Event ID 4625.
If you have a lot of events, the output can be huge. So let's narrow it down.
Check the Last 24 Hours
Use:
Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4625
StartTime=(Get-Date).AddDays(-1)
}
This checks for failed logon events from roughly the last 24 hours.
That's a handy command to keep around when you're troubleshooting a login problem.
Count Failed Login Attempts
Want to know how many failed logons occurred today?
Try:
(Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4625
StartTime=(Get-Date).Date
} -ErrorAction SilentlyContinue).Count
If it returns:
7
that means Windows found seven matching Event 4625 entries since the start of the current day.
This is much faster than manually counting them in Event Viewer.
Find Recent Failed Logins More Clearly
You can also display the time and message:
Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4625
StartTime=(Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Id, Message
Now you can quickly see when each event happened and read its details.
If you're troubleshooting a login problem, this is often easier than opening every event separately.
What If You Don't See Event 4625?
This is important.
If you search the Security log and don't find Event 4625, that doesn't automatically mean nobody has ever failed to log in.
The required auditing may not have been enabled when the attempts happened.
So Windows can't show you an event that it wasn't configured to record.
Think of it like a security camera. If the camera wasn't recording yesterday, you can't magically recover yesterday's footage.
Check Whether Failed Logon Auditing Is Enabled
On supported Windows editions, you can check the current audit setting from an elevated Command Prompt or Terminal.
Run:
auditpol /get /subcategory:"Logon"
Look for whether Failure auditing is enabled.
If you manage a Windows PC or organization and need to start recording failed logons, you can configure the Audit Logon policy to include failures.
For example, from an elevated Terminal:
auditpol /set /subcategory:"Logon" /failure:enable
After enabling it, future failed logon attempts can be recorded.
Important: This doesn't create missing events from the past. It only affects logging going forward.
Find Failed RDP Login Attempts
If you're specifically worried about someone trying to access your PC through Remote Desktop, Event 4625 becomes especially useful.
Look for: Event ID: 4625
and pay attention to: Logon Type: 10
Logon Type 10 is associated with Remote Desktop-related logons.
If you see repeated Type 10 failures from the same source address, that's a much stronger reason to investigate.
If you don't use Remote Desktop, there's also little reason to leave unnecessary remote access exposed.
Are All Failed Logins Dangerous?
No. This is probably the most important point in the whole article.
A failed login can happen for completely normal reasons.
- You typed the wrong password.
- An old password is saved somewhere.
- A mapped network drive is using old credentials.
- A service is trying an old account password.
- Another PC is trying to access a shared folder.
- A scheduled task has outdated credentials.
- Remote Desktop credentials are incorrect.
- A phone or another device is trying to reconnect to a shared resource.
So don't treat Event 4625 as proof of hacking.
Instead, look for a pattern.
When Should You Be Concerned?
I'd pay much more attention when several things line up.
| Finding | How Concerning? |
|---|---|
| One failed login after you mistyped your password | Very low |
| A few local failures from your own account | Low |
| Repeated failures from a known home device | Usually low |
| Repeated network failures from an unknown device | Worth checking |
| Many failures in a short period | Concerning |
| Repeated Remote Desktop failures | More concerning |
| Unknown source repeatedly targeting an account | Needs investigation |
| Large burst of failures from one source | Potential brute-force activity |
The exact risk depends on your setup.
A home laptop behind a properly configured router is very different from an internet-facing Windows Server with Remote Desktop exposed to the internet.
Context matters.
A Useful Trick: Compare the Times
Here's something particularly useful when troubleshooting repeated 4625 events.
Look at when they happen.
If you see one every few minutes, at almost exactly the same time, and the same account is being targeted, there may be a service or scheduled task behind it.
For example, suppose you see failed logons at:
- 10:00 AM
- 10:05 AM
- 10:10 AM
- 10:15 AM
That's a very different pattern from 100 attempts arriving within two minutes from an unknown network address.
The clock can tell you a surprising amount.
What You Shouldn't Do
Don't start deleting security logs just because you see failed login events.
And don't immediately install a random "Windows security cleaner" that promises to fix Event 4625.
First find out why the events are happening.
If they're caused by your own service, scheduled task, mapped drive, or another device, removing the logs won't fix the problem. It'll just erase the clues.
If the activity really is suspicious, you want those records available while you investigate.
The Bottom Line
The easiest way to find failed login attempts in Windows is to open:
Event Viewer → Windows Logs → Security
Then filter for: Event ID 4625
That's the main Windows security event for a failed logon.
Open the event and check the account name, logon type, failure reason, status, sub-status, process information, and source network address. These details can help you work out whether the failed attempt came from a normal Windows process, another device on your network, or something that deserves closer attention.
For a quicker check, PowerShell can search the Security log with:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
And here's the big catch: Windows can only show events that were actually logged. If failed-logon auditing wasn't enabled when an attempt happened, you generally won't be able to go back later and recover that missing event.
Finally, don't let one scary-looking 4625 event ruin your day. One failed password is normal. A repeated pattern involving an unknown account, unknown source, or many Remote Desktop attempts is where you should start paying serious attention.
That's the difference between simply finding a security event and actually understanding what it means.