> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/failed-logons.md).

# Failed Logons

## Objective

Generate a small number of failed domain logons inside the lab and identify the resulting Windows security events.

## Safety Note

Use only the ZyberLab account and systems. Do not test passwords or generate repeated authentication failures against systems you do not own or have explicit permission to test.

Keep this exercise small. Two or three deliberate failures are enough to understand the event.

## Lab System

Use `CLIENT01` and the lab domain account.

## Steps

### 1. Sign Out

On `CLIENT01`, sign out.

### 2. Enter an Incorrect Password

Select the lab domain account and intentionally enter an incorrect password once or twice.

Do not repeatedly guess passwords.

### 3. Sign In Correctly

After generating the test failures, sign in with the correct lab password.

### 4. Review Security Events

Open Event Viewer and go to:

```
Windows Logs
└── Security
```

Filter for:

```
4625
```

### 5. Inspect the Event

Review fields such as:

* Account Name
* Account Domain
* Failure Reason
* Status
* Sub Status
* Logon Type
* Workstation Name
* Source Network Address, if available

## What Happened?

Windows rejected the supplied credentials and recorded a failed logon event.

The exact location and details of authentication events can vary depending on the authentication method and which system processed the request.

## Security Relevance

Failed logons are common in normal environments. They become more important when patterns appear, such as:

* many failures for one account
* failures across many accounts
* repeated failures from one source
* failures against privileged accounts
* a successful logon immediately after repeated failures

This is why detection rules usually evaluate patterns rather than treating a single failed password as an incident.

## Key Takeaways

* Event ID 4625 represents a failed logon.
* Failure reason and logon type provide useful context.
* A small number of failures can be normal user behavior.
* Repeated or unusual patterns are more relevant for security monitoring.