How to Check Failed Login Attempts on Windows 10 and 11 (Event ID 4625)

To check failed login attempts on Windows 10 or 11, open Event Viewer as an administrator, go to Windows Logs > Security, choose Filter Current Log and enter Event ID 4625. Every 4625 entry is one failed sign-in, and it tells you which account was tried, how (the logon type), why it failed (the status code) and which computer or IP address it came from. If the list is empty, check that failure auditing is switched on with auditpol /get /subcategory:"Logon".

Maybe you just want to know whether anyone has been trying their luck while you were away. Windows keeps a record, and it's far more detailed than most people expect. Below, you'll confirm Windows is recording failures, find them, then decode each field so you can tell a typo from a real problem.

In this guide:

• Check that Windows is recording failed sign-ins
• How to find failed login attempts in Event Viewer
• What each field in a 4625 event tells you
• Logon types: how the attempt was made
• Status codes: why the sign-in failed
• How to check failed logins with PowerShell
• Other Security log events worth checking
• What's normal and what deserves a closer look
• How Windows limits password guessing
• If you think someone is trying to get in
• Checking failed sign-ins for your Microsoft account
• Frequently asked questions

Check that Windows is recording failed sign-ins

Windows only logs a failed sign-in if the Audit Logon policy is set to record failures. The good news is that you probably don't need to change anything. According to Microsoft's audit policy recommendations, Audit Logon has been enabled for both success and failure by default since Windows 10 version 1809. Older versions recorded successes only.

To confirm:

1. Press the Windows key, type cmd, right-click Command Prompt and choose Run as administrator.
2. Run the command below.
3. Look at the line for Logon.

auditpol /get /subcategory:"Logon"

System audit policy
Category/Subcategory                      Setting
Logon/Logoff
  Logon                                   Success and Failure

If it says Success or No Auditing, switch failures on:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

This works on Windows Home too, which lacks the Local Security Policy editor older guides mention. Subcategory names are translated on non-English Windows, and auditing only records attempts from the moment it's on.

How to find failed login attempts in Event Viewer

Event Viewer is built into every edition of Windows 10 and 11. The Security log needs administrator rights, so open it from an admin account.

1. Press Windows + R, type eventvwr.msc and press Enter. (You can also right-click Start and choose Event Viewer.)
2. In the left pane, expand Windows Logs and click Security. If you see "Access is denied", close it and run Event Viewer as administrator.
3. In the right-hand Actions pane, click Filter Current Log.
4. In the box that says <All Event IDs>, type 4625.
5. Set Logged to a sensible window, such as Last 7 days, and click OK.
6. Click any event and read the General tab underneath, or double-click it for a bigger window.

To see successful sign-ins alongside the failures, type 4624,4625 instead. That's useful for spotting a failure followed shortly by a success from the same place, which is the pattern that deserves the closest look. Microsoft's Event 4625 reference documents every field in the event.

Filtering never deletes anything; Clear Filter takes you back to the full log.

What each field in a 4625 event tells you

Only a handful of fields matter for a home or small-office check.

Read them together. Logon Type 2, winlogon.exe and 127.0.0.1 is someone at the sign-in screen. Type 3 with another IP address on your network is a device trying to connect, often to a shared folder.

Logon types: how the attempt was made

The Logon Type number is the quickest way to tell where an attempt came from. These are the values Microsoft documents, with what they usually mean on a personal or small-business PC.

Types 4 and 5 usually point to a program with an old saved password, not a person.

Status codes: why the sign-in failed

The Failure Reason line gives a plain-English summary, but the hexadecimal Status and Sub Status codes are more precise. When Status is the general 0xC000006D, the Sub Status tells you the real reason. These are the codes Microsoft lists in its monitoring guidance for this event.

A run of 0xC0000064 events with names like admin, administrator or user is the classic sign of an automated tool working through a list, because none of those are real accounts on a typical home PC.

How to check failed logins with PowerShell

Event Viewer is fine for a quick look, but PowerShell turns a week of events into a tidy table in seconds. Open Terminal (Admin) or Windows PowerShell (Admin) from the Start button's right-click menu, then paste this:

$f = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} |
  Select-Object TimeCreated,
    @{n='Account';     e={$_.Properties[5].Value}},
    @{n='LogonType';   e={$_.Properties[10].Value}},
    @{n='SubStatus';   e={'0x{0:X8}' -f $_.Properties[9].Value}},
    @{n='Workstation'; e={$_.Properties[13].Value}},
    @{n='SourceIP';    e={$_.Properties[19].Value}}
$f | Format-Table -AutoSize

The numbers in square brackets pick fields in the order Windows stores them (5 is the account, 19 the source IP). Change -7 to look further back.

To see who is trying most often, group the results:

$f | Group-Object SourceIP | Sort-Object Count -Descending | Select-Object Count, Name
$f | Group-Object Account  | Sort-Object Count -Descending | Select-Object Count, Name

If there are no matching events, PowerShell says "No events were found that match the specified selection criteria". That's an error message, but it's good news. Microsoft's Get-WinEvent documentation covers more filter keys, such as limiting results with -MaxEvents.

Other Security log events worth checking

A few related event IDs show what happened before and after a failure.

Event 4672 appears whenever an admin account signs in, which is another reason to use a standard account for everyday work, as I explain in my guide to what UAC is in Windows.

What's normal and what deserves a closer look

Most failed sign-ins are harmless.

• Probably nothing: one or two Type 2 or Type 7 failures with 0xC000006A at times you were using the PC. That's you mistyping.
• An annoyance, not an attack: a steady drip of Type 3, 4 or 5 failures for your own account, often from another device on your network. A phone, NAS, old laptop or scheduled task is still using a password you've since changed. Update the saved password on that device and the failures stop.
• Worth investigating: failures at times nobody was home, failures for user names that don't exist, or Type 3 and Type 10 attempts from IP addresses you don't recognise.
• Act now: many failures followed by a 4624 success from the same source, or a 1102 event you can't explain.

If you see Type 10 attempts, check whether Remote Desktop is switched on under Settings > System > Remote Desktop, and turn it off if you don't use it. Windows Home can't host Remote Desktop sessions at all. Network attempts from outside your home usually mean something is reachable that shouldn't be, so it's worth learning how to check open ports on the same PC.

How Windows limits password guessing

Account lockout locks an account for a while after a set number of wrong passwords, which makes guessing very slow.

Microsoft's KB5020282 support article explains that new Windows 11 version 22H2 installations, and new PCs set up with the October 2022 updates already applied, get a default of 10 failed attempts within 10 minutes causing a 10-minute lockout. There's an important detail: this lockout applies to network sign-ins such as Remote Desktop. Console sign-ins at the keyboard are still allowed during the lockout period. PCs that were set up earlier and updated later don't get these settings automatically.

To see your current policy, run this in an admin Command Prompt:

net accounts

If you think someone is trying to get in

Failed attempts mean the password held. Work through these steps:

1. Write down the times, account names, logon types and source addresses from the events, or save the filtered view with Save Filtered Log File As in Event Viewer.
2. Check for any 4624 success from the same source just after the failures.
3. Change the password for the targeted account to something long and unique. My free password generator runs entirely in your browser and can produce a three-random-words passphrase.
4. Turn off Remote Desktop, file sharing or anything else that allows network sign-ins you don't need.
5. Make sure Windows Update and Microsoft Defender are current, then run a full scan.
6. If attempts came from another device on your network that you don't own, change your Wi-Fi password and review which devices are connected to your router.

If an attempt succeeded and it wasn't you, disconnect the PC from the internet and get help before using it for banking or email.

Checking failed sign-ins for your Microsoft account

The Security log only covers sign-ins to this PC. If you sign in to Windows with a Microsoft account, attempts made online, through Outlook.com or any Microsoft website, are recorded by Microsoft instead.

1. Go to account.microsoft.com/security and sign in.
2. Open your sign-in activity.
3. Look for entries labelled Incorrect password entered or an Unusual activity section.
4. Expand anything you don't recognise to see its location, device and IP address.

Microsoft's page on the Recent activity page says it covers the last 30 days. Mobile networks can make your own sign-ins look as if they came from elsewhere, so check the device type first. Two-step verification stops a guessed password being enough.

Frequently asked questions

Where are failed login attempts stored in Windows?

They're stored in the Security event log, which lives at C:\Windows\System32\winevt\Logs\Security.evtx. Don't open the file directly. Use Event Viewer or PowerShell's Get-WinEvent, both of which need administrator rights to read it.

Can I see failed logins on Windows 11 Home?

Yes. Event Viewer, PowerShell and the auditpol command are all included in Windows 11 Home. What Home lacks is the Local Security Policy editor, so use auditpol from an admin Command Prompt if you need to switch failure auditing on.

Why can't I find any 4625 events?

Usually for one of three reasons: nobody has failed to sign in during the period you filtered, failure auditing was switched off, or older events were overwritten when the log reached its size limit. Run auditpol /get /subcategory:"Logon" to rule out the second one.

What does logon type 3 mean in event 4625?

Type 3 is a network sign-in. Another device tried to connect to this PC, most often to a shared folder or printer. Repeated Type 3 failures for your own account usually come from a device still using an old saved password.

Does Windows lock you out after too many wrong passwords?

It can. New Windows 11 22H2 installations default to locking an account for 10 minutes after 10 failed attempts within 10 minutes, but Microsoft says that lockout applies to network sign-ins such as Remote Desktop, not to the keyboard. Run net accounts to see your PC's actual setting.

How long does Windows keep the Security log?

There's no fixed number of days. The log has a maximum size and overwrites the oldest events once it's full. Run wevtutil gl Security in an admin Command Prompt to see the maxSize value in bytes, and save events you want to keep.

Is it safe to clear the Security log?

You can, but there's rarely a good reason to. Clearing it destroys the evidence you'd need if something went wrong, and Windows records event 1102 when the log is cleared, so an unexpected 1102 is itself a warning sign.

Last checked: 23 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.