0xC0000064: Logon Failure for a Username That Does Not Exist
Published
Someone tried to log on with an account name that does not exist. Occasional typos are normal; bursts of invented names from one source are username guessing or spraying with a generic list.
Did the attacker have the password? No — the password (or username) was wrong.
Microsoft's definition
STATUS_NO_SUCH_USER
The specified account does not exist.
Microsoft's 4625 monitoring note: "User logon with misspelled or bad user account". Especially if you get several of these events in a row, it can be a sign of a user enumeration attack.
Source: [MS-ERREF] NTSTATUS Values · checked against the published table on every build
Where it appears
- Event 4625 (An account failed to log on): the Sub Status field, usually alongside Status 0xC000006D
- Event 4776 (credential validation, NTLM) on domain controllers: the Error Code field
- Microsoft Sentinel / Log Analytics: the SubStatus and Status columns of the SecurityEvent table
What it means
Sub Status 0xC0000064 — STATUS_NO_SUCH_USER — means the name in the logon attempt did not match any account on the computer or in the domain. No password was checked because there was nothing to check it against. On domain controllers, the same value appears as the Error Code of event 4776 for NTLM attempts.
Where it is logged depends on the account and protocol. For a local account the target computer logs the 4625. For a domain account over NTLM the member server logs 4625 and the domain controller logs 4776; over Kerberos the domain controller records event 4768 with failure code 0x6 instead.
On its own it is the most harmless-looking failure code. In volume it is one of the clearest attack signals in the Security log, because real users rarely mistype their own username repeatedly.
Is it an attack?
- A burst of generic names (administrator, admin, test, user, guest) from an external IP — automated scanning of exposed RDP or SMB. Expect it on anything internet-facing; act on the exposure.
- Many plausible names (first.last, initials) from one source — guessing based on harvested employee names, often the start of a spray.
- A mix of 0xC0000064 and 0xC000006A from one source — a spray in progress that has found real accounts.
- One stale name, one internal host, a regular interval — a task, service or mapped drive pointing at a deleted account.
Microsoft’s own monitoring note for this code warns that several of these events in a row can be a sign of a user enumeration attack.
How to investigate
Find sources that tried many non-existent names:
SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4625 and SubStatus =~ "0xc0000064"
| summarize Attempts = count(), DistinctNames = dcount(TargetUserName),
SampleNames = make_set(TargetUserName, 20), LogonTypes = make_set(LogonType, 5)
by IpAddress, WorkstationName, Computer
| where DistinctNames >= 5
| order by DistinctNames descFor each source, check whether it also produced 0xC000006A (real accounts found) or a 4624 success. If the source is external, close or restrict the exposed service — RDP and SMB should not be reachable from the internet — and block the address. If it is internal, the host is either misconfigured or compromised; the regularity of the attempts usually tells you which. The Windows 4625 password-spray rule covers the detection side.
Related codes
- 0xC000006A STATUS_WRONG_PASSWORD The account exists and the password was wrong. One event is a typo; many against one account is brute force; one source failing across many real accounts is password spraying.
- 0xC000006D STATUS_LOGON_FAILURE The logon was rejected as invalid without saying which half was wrong — it is the general failure result that event 4625 usually carries in Status, with the real reason in Sub Status.
- 0xC0000072 STATUS_ACCOUNT_DISABLED
- 0xC0000193 STATUS_ACCOUNT_EXPIRED
Detect it
Frequently Asked Questions
- Which usernames do attackers try?
- Internet-facing RDP and SMB see the same short list over and over: administrator, admin, user, test, guest, backup and their variants in other languages. A burst of 0xC0000064 with names like these from an external IP is automated scanning rather than a targeted attack, but it proves the service is reachable from the internet, which is the finding to act on.
- Can 0xC0000064 come from legitimate systems?
- Yes. A deleted or renamed account still configured in a scheduled task, service, script or mapped drive fails with this code on every retry. The pattern is one name, one source host, a regular interval, and a name that used to exist in the directory. Fixing or removing the stale configuration stops it.
- How is 0xC0000064 different from 0xC000006A?
- 0xC0000064 means the account does not exist; 0xC000006A means it exists and the password was wrong. A source producing mostly 0xC0000064 is still guessing names. One that starts producing 0xC000006A has found real accounts, and that switch is the moment to escalate the investigation.
- How do I find the machine that sent the attempts?
- In event 4625 the Workstation Name and Source Network Address fields identify the client, and domain controllers record the source workstation in event 4776 for NTLM attempts. Behind a VPN concentrator, gateway or proxy the address may be the gateway itself, so continue in that device's own logs to reach the real origin.
Find 0xC0000064 in your own logs
Load a Windows Security event export into the free browser analyzer to group failures by account, source IP and status code (nothing is uploaded), or run it through LogTriage for threat-intel enrichment and an AI-written incident report.