What to collect
- Username and account type.
- Source network address.
- Logon type.
- Authentication package or method.
- Host and timestamp.
- Related failures or successes.
RR CYBERLAB • Windows Security
Windows Event ID 4624 & 4625
Use successful and failed Windows logon events as the foundation of authentication investigations.
QUICK READ
Event ID 4624 records a successful logon and 4625 records a failed logon. The surrounding fields and sequence matter more than the event ID alone.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Group events by user, source IP and host.
- Look for repeated failures and timing patterns.
- Check whether a successful login follows failures.
- Validate whether the source device and location are expected.
- Pivot to process, network and file activity after successful authentication.
Example
Twenty-five failed attempts for one account followed by a successful login and then PowerShell execution should be treated as a correlated timeline requiring investigation. It is not enough to label the first failures as brute force without checking the broader evidence.Common mistakes
- Assuming failed authentication equals compromise.
- Ignoring service accounts and scheduled jobs.
- Failing to inspect activity after a successful login.
Daily quiz hook
Which log event is associated with a failed Windows logon: 4624 or 4625?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
Windows Security Event 4624 records a successful logon and 4625 a failed attempt, but the event fields and logon type determine how to interpret the record. Review account, source, workstation, authentication package, status/substatus, and surrounding events.
Compare a fictional 4625 burst with a later 4624 and check identity, host, and authentication context. Service activity, stale credentials, and user error are possible explanations; a success after failures deserves follow-up but is not conclusive alone.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.