Windows Logon Failure Codes (4625 Status & SubStatus)
When a Windows logon fails, event 4625 records two NTSTATUS values: Status and
SubStatus. Status is often the generic 0xC000006D ("bad username or authentication
information"); SubStatus carries the specific reason — wrong password, unknown user, locked or disabled account.
Domain controllers log the same values in 4776 (NTLM credential validation) as
Error Code, and the same failure can surface as a 4625 on the member server and a 4776 on the DC.
Read them in pairs. A burst of 0xC0000064 (no such user) against many names is username enumeration
or spraying with a guessed list; 0xC000006A (wrong password) concentrated on a few real accounts is
brute force; a 0xC0000234 lockout right after either means the attempt hit the lockout threshold.
Each page quotes Microsoft's NTSTATUS definition verbatim and gives the KQL or SPL to check your own data.
| Code | What it means | Password correct? | Triage |
|---|---|---|---|
| 0xC000006A STATUS_WRONG_PASSWORD | The account exists and the password was wrong. One event is a typo; many against one account is brute force; one source failing across many real accounts is password spraying. | No | medium |
| 0xC000006D STATUS_LOGON_FAILURE | The logon was rejected as invalid without saying which half was wrong — it is the general failure result that event 4625 usually carries in Status, with the real reason in Sub Status. | No | medium |
| 0xC0000064 STATUS_NO_SUCH_USER | Someone tried to log on with an account name that does not exist. Occasional typos are normal; bursts of invented names from one source are username guessing or spraying with a generic list. | No | medium |
| 0xC0000234 STATUS_ACCOUNT_LOCKED_OUT | The account is locked because the lockout threshold was reached; every further attempt fails with this code until the lockout ends or an administrator unlocks it. | Unclear | medium |
Group your own 4625 failures by code
Load a Windows Security event export into the free browser analyzer to see failures by account, source IP and SubStatus, with spraying and lockouts flagged. Nothing is uploaded.