> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-failed-logons.md).

# Investigate Failed Logons

## Objective

Investigate a small number of failed sign-in attempts and identify the account, source system, time, and likely reason for the failures.

## Lab Systems

* `DC01`
* `CLIENT01`

## Generate Test Activity

Use a dedicated lab account such as `labuser01`.

On `CLIENT01`, enter an incorrect password once or twice at the Windows sign-in screen or another normal authentication prompt.

Do not repeatedly guess passwords or create unnecessary account lockouts.

## Find the Evidence

On the system recording the authentication event, open:

```
Event Viewer
Windows Logs
Security
```

Filter for:

```
4625
```

Event ID `4625` represents a failed logon.

## Investigate the Event

Review the event and identify:

* time of the failure
* account name
* computer involved
* logon type
* source address or workstation information when available
* failure reason or status information

Then look at nearby events to determine whether a successful logon occurred shortly before or after the failures.

## Ask the Investigation Questions

Record answers to these questions:

1. Which account failed to authenticate?
2. Which system generated the activity?
3. How many failures occurred in the selected time window?
4. Did a successful sign-in follow the failures?
5. Was the activity expected as part of the lab?

## Example Finding

A simple finding may look like this:

```
Two failed logons were observed for labuser01 from CLIENT01.
The activity occurred during the planned lab test.
A normal successful sign-in followed after the correct password was entered.
No additional suspicious activity was observed in the same time window.
```

## Security Relevance

A single failed logon is common. Repeated failures, failures against privileged accounts, unusual source systems, or failures followed by unexpected success can require deeper investigation.

The important lesson is to evaluate the event in context rather than treating every authentication failure as an incident.