Where can I find the full list of Failure Reasons for event 4625?

I'm pulling the Failed Login events from Windows 2008 Domain Controller Servers, and have found many Status and Sub-Status values to which I can't relate a description.

 

The Status values are:

 

STATUS DESCRIPTION
0XC0000234 user is currently locked out
0XC0000193 account expiration
0XC0000133 clocks between DC and other computer too far out of sync
0XC0000224 user is required to change password at next logon
0XC0000225 evidently a bug in Windows and not a risk
0XC000015B The user has not been granted the requested logon type (aka logon right) at this machine
0XC000006D This is either due to a bad username or authentication information
0XC000006E Unknown user name or bad password.
0XC00002EE Failure Reason: An Error occurred during Logon
0XC000005E ?
0XC00000DC ?
0XC0000192 ?
0XC0000413 ?
0XC000009A ?

 

 

The Sub Status Values are:

 

SUB_STATUS DESCRIPTION
0XC000006D This is either due to a bad username or authentication information
0XC000006D This is either due to a bad username or authentication information
0XC000006E Unknown user name or bad password.
0XC000006E Unknown user name or bad password.
0XC0000193 account expiration
0XC000006E Unknown user name or bad password.
0XC000006D This is either due to a bad username or authentication information
0XC000006D This is either due to a bad username or authentication information
0XC000018C ?
0XC000005E ?
0XC00000DC ?
0XC0000224 user is required to change password at next logon
0XC0000192 ?
0XC0000413 ?

Can you please help me find a list with all the possible values and their description?

 

Thanks,

Eli

Answer
Answer
SUB_STATUS DESCRIPTION
0XC000006D This is either due to a bad username or authentication information
0XC000006D This is either due to a bad username or authentication information
0XC000006E Unknown user name or bad password.
0XC000006E Unknown user name or bad password.
0XC0000193 account expiration
0XC000006E Unknown user name or bad password.
0XC000006D This is either due to a bad username or authentication information
0XC000006D This is either due to a bad username or authentication information
0XC000018C

The logon request failed because the trust relationship between the primary domain and the trusted domain failed.

0XC000005E

There are currently no logon servers available to service the logon request.

0XC00000DC

Indicates the Sam Server was in the wrong state to perform the desired operation.

0XC0000224 user is required to change password at next logon
0XC0000192

An attempt was made to logon, but the netlogon service was not started.

0XC0000413

Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine.

Can you please help me find a list with all the possible values and their description?

 

Thanks,

Eli


I come accross the same issue today and found your post a good starting point.

You may find useful to check for status codes in the Window header file ntstatus.h (I think you could get a copy by installing the Windows SDK).  There you can find status codes, MessageIds and MessageTexts.

 

I have completed the missing codes in your table, but you could also check for other values.

 

Bye,

Gabriele

 

 

 

43 people found this reply helpful

·

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated February 27, 2024 Views 137,537 Applies to: