How to detect brute-force or failed logon attempts on Windows with event viewer and PowerShell

Situatie

How to see who tried to sign in to the machine, from where, with which account, and how to tell a typo from an attack.

Prerequisites

Administrator rights (the Security log is restricted)
Logon auditing enabled. This is the default on Windows client versions, and you can confirm it with:

  auditpol /get /subcategory:"Logon"

Look for “Success and Failure”.

Solutie

Method A: Event Viewer

Press Win + R, type eventvwr.msc and press Enter.
Go to Windows Logs → Security.
Click Filter Current Log… in the right pane.
Enter 4625 in the Event IDs box. This is the “an account failed to log on” event. Click OK.
Open an event and read the General tab:
- Account Name: the account that was targeted
- Logon Type: how the attempt was made
- Source Network Address: the origin
- Failure Reason / Status / Sub Status: why it failed

Logon types

2: interactive (keyboard at the machine)
3: network (SMB, file shares)
5: service
7: unlock
10: Remote Desktop

Sub Status codes

0xC000006A: valid username, wrong password
0xC0000064: username does not exist
0xC0000234: account locked out
0xC0000072: account disabled

Method B: Summarize attempts by source with PowerShell

Run in an elevated PowerShell:

powershell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-7)} |
ForEach-Object {
  $x = [xml]$_.ToXml()
  $d = @{}
  $x.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
  [pscustomobject]@{
    Time   = $_.TimeCreated
    User   = $d.TargetUserName
    Type   = $d.LogonType
    IP     = $d.IpAddress
    Status = $d.SubStatus
  }
} | Group-Object IP | Sort-Object Count -Descending |
    Select-Object -First 10 Count, Name

This ranks the top ten source addresses by number of failed logons in the last 7 days. If the query returns nothing, there were no matching events in that window.

How to interpret the results

A few type 2 or 7 failures from the machine itself are usually typos.
Dozens or hundreds of type 3 or 10 failures from the same external IP, often with different usernames like admin, test or user, are a brute-force or password-spraying attempt.
A 4625 burst followed by a 4624 (successful logon) from the same IP is serious. Treat the machine as compromised and investigate.
Event 4740 indicates an account lockout.

Reduce the exposure

Check whether Remote Desktop is listening:

powershell

   Get-NetTCPConnection -LocalPort 3389 -State Listen

If you don’t use RDP, disable it (Settings → System → Remote Desktop → Off).
If you do use it, don’t expose port 3389 directly to the internet. Use a VPN.
Set an account lockout threshold:

   net accounts /lockoutthreshold:5

Use long, unique passwords, and Windows Hello or MFA where available.

Keep enough history

The default Security log is only about 20 MB and overwrites old events. To raise it to 128 MB:

wevtutil sl Security /ms:134217728

Export evidence

In Event Viewer, use Save Filtered Log File As… to save a .evtx file you can analyze later or hand to a security team.

Verification

After the changes, re-run the PowerShell summary a day later. The count of external-source failures should drop sharply if you closed an exposed service.

Caveats

Source IPs can be spoofed or proxied, so treat them as indicators, not proof.
A large number of failures from a legitimate internal address may mean a service or scheduled task is using an outdated password.

Tip solutie

Permanent

Follow Us