Share via

Something Wrong with 4625 AuditLog

Eric Jiang 0 Reputation points
2024-01-22T07:31:32.59+00:00

System Version: Win 10，Win 11 I use app to test login brute force. Sometime 4625 could record src-ip & src-port,sometime could not,also sometime have null 4625 log. Please tell me how to solve,thanks very much!

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,842 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
8,994 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daisy Zhou 21,436 Reputation points Microsoft Vendor
    2024-01-23T01:59:31.47+00:00

    Hello Eric Jiang,

    Thank you for posting in Q&A forum.

    Based on the description, it seems your win10 and win11 are in workgroup.

    What account did you use to logon? Are they local user accounts?

    This event is logged for any logon failure. It generates on the computer where logon attempt was made, for example, if logon attempt was made on user's workstation, then event will be logged on this workstation.

    Sometime 4625 could record src-ip & src-port,sometime could not, also sometime have null 4625 log.
    Check if these event ID 4625 have the same account you are using now. User's image

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

    I hope the information above is helpful. If you have any questions or concerns, please feel free to let us know. Best Regards, Daisy Zhou

    If the Answer is helpful, please click "Accept Answer" and upvote it.