Windows logon failure codes: event 4625 and 4776 status codes and account lockout 4740

Event 4625 says a logon failed, 4776 says a domain controller rejected NTLM credentials, and 4740 says the account is now locked out. The hex status codes in those events tell you why, and a few fields tell you where the attempt came from. This quick reference decodes the codes Microsoft documents for these events and then walks through tracing a lockout back to the device or service that still holds an old password.

How to read these codes#

When Status is 0xC000006D, the Sub Status holds the real reason. The Logon Type points to what made the attempt:

Bad user name or password#

Account state and restrictions#

Domain controller, time and trust problems#

Microsoft's broken trust relationship guide covers recurring secure channel failures, and Domain trust failures after KB5124008 covers the 2026 Windows 11 case. Any other code is an NTSTATUS value: look it up in Microsoft's NTSTATUS values list.

Trace an account lockout to its source#

1. Read 4740 on the PDC emulator#

The PDC emulator sees the lockout, so start there. In the event XML, the Caller Computer Name is stored in the TargetDomainName field:

$pdc = (Get-ADDomain).PDCEmulator
Get-WinEvent -ComputerName $pdc -FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 50 |
    ForEach-Object {
        $d = @{}
        ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
        [pscustomobject]@{ Time = $_.TimeCreated; User = $d.TargetUserName; CallerComputer = $d.TargetDomainName }
    }

2. Compare the account on every DC#

badPwdCount and the last bad password time are kept separately on each DC and aren't replicated. Besides the PDC emulator, which also records forwarded attempts, the DCs showing recent bad attempts tell you which site the bad password came through:

Get-ADDomainController -Filter * | ForEach-Object {
    $dc = $_.HostName
    Get-ADUser alex -Server $dc -Properties LockedOut, badPwdCount, LastBadPasswordAttempt |
        Select-Object @{n='DC'; e={$dc}}, LockedOut, badPwdCount, LastBadPasswordAttempt
}

3. Go to the caller computer#

On the computer named in 4740, read the 4625 events for that account. Logon Type 4 or 5 points to a scheduled task or service, 3 to a network client (follow the Source Network Address), 10 to a Remote Desktop session. If the caller is a server that authenticates on behalf of users, such as a mail, web, AD FS or VPN server, the stale password lives on a device behind it, so check that server's own logs.

4. No caller name? Turn on Netlogon logging#

For NTLM attempts, 4776 on the DCs shows the Source Workstation; for Kerberos, 4771 with 0x18 shows the Client Address. When neither is enough, enable Netlogon debug logging on the DCs (or deploy the Computer Configuration › Administrative Templates › System › Net Logon › Specify log file debug output level policy), reproduce, and search the log for the user and 0xC000006A or 0xC0000234:

nltest /dbflag:0x2080ffff
:: reproduce, then read %windir%\debug\netlogon.log
nltest /dbflag:0x0

5. Fix the source, then unlock#

Update or remove the stale credential: a service or scheduled task, saved credentials in Credential Manager, a persistent mapped drive, a phone's mail profile, a script, or a disconnected Remote Desktop session. Only then unlock:

Search-ADAccount -LockedOut | Select-Object SamAccountName, LastLogonDate
Unlock-ADAccount -Identity alex

Unlocking before the source is fixed just starts the next lockout. With pass-through authentication, cloud sign-ins count against the AD threshold too; AADSTS50053 and on-premises lockouts explains how the two policies interact.

How to verify a fix#

1. No new 4740 for the account on the PDC emulator through at least one full cycle of whatever caused it: a daily task needs a day, not five minutes.
2. badPwdCount stays at 0 on every DC, and the 4625 or 4776 failures from the old source stop.
3. The user signs in, and 4624 (successful logon) appears where 4625 used to.
4. Netlogon logging is back to 0x0 on every DC where you enabled it.

References#

• 4625(F): An account failed to log on and 4776(S, F): The computer attempted to validate the credentials for an account (source of the code tables)
• 4740(S): A user account was locked out
• Enable debug logging for the Netlogon service