Vendors / Microsoft Corporation / Windows / Windows 4625 locked-out interactive logon

Event type

Windows 4625 locked-out interactive logon

Event 4625 Version 0 locked-out interactive logon; registry user, computer and domain; UTC clock and synthetic independent record ID.

XML 38 fields Generator

windows security authentication

Preview Sample View Schema

CLI Install

meltr templates install microsoft

Overview

What this event covers

Documented locked-out-account XML scenario. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/microsoft/windows/security-4625.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›An interactive logon to a locked account fails.

Security relevance

Informational

Frequency notes

3600/hour test rate; independent event snapshots, not an ordered channel replay.

Resources

Docs and tools

Microsoft Event 4625 XML and definitions official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

Event/@xmlns

String Required

Fixed http://schemas.microsoft.com/win/2004/08/events/event

Source: Fixed http://schemas.microsoft.com/win/2004/08/events/event

System/Provider/@Name

String Required

Fixed `Microsoft-Windows-Security-Auditing`.

Source: Fixed `Microsoft-Windows-Security-Auditing`.

System/Provider/@Guid

String Required

Fixed `{54849625-5478-4994-A5BA-3E3B0328C30D}`.

Source: Fixed `{54849625-5478-4994-A5BA-3E3B0328C30D}`.

System/EventID

String Required

Fixed `4625`.

Source: Fixed `4625`.

System/Version

String Required

Fixed `0`.

Source: Fixed `0`.

System/Level

String Required

Fixed `0`.

Source: Fixed `0`.

System/Task

String Required

Fixed `12546`.

Source: Fixed `12546`.

System/Opcode

String Required

Fixed `0`.

Source: Fixed `0`.

System/Keywords

String Required

Fixed `0x8010000000000000`.

Source: Fixed `0x8010000000000000`.

System/TimeCreated/@SystemTime

String Required

now() converted to UTC, then one Z. The organization offset is not left on the timestamp.

Source: clock | iso8601_utc

System/EventRecordID

String Required

Faker pyint 1–4294967295; synthetic positive record number, independently sampled.

Source: Faker pyint 1–4294967295; synthetic positive record number, independently sampled.

System/Correlation

String Required

Retained empty, as in the reference.

Source: Retained empty, as in the reference.

System/Execution/@ProcessID

String Required

Fixed `516`.

Source: Fixed `516`.

System/Execution/@ThreadID

String Required

Fixed `3240`.

Source: Fixed `3240`.

System/Channel

String Required

Fixed `Security`.

Source: Fixed `Security`.

System/Computer

String Required

Selected device hostname + organization DNS domain.

Source: Selected device hostname + organization DNS domain.

System/Security

String Required

Retained empty, as in the reference.

Source: Retained empty, as in the reference.

EventData/SubjectUserSid

String Required

Fixed `S-1-5-18`.

Source: Fixed `S-1-5-18`.

EventData/SubjectUserName

String Required

Same device hostname + $.

Source: Same device hostname + $.

EventData/SubjectDomainName

String Required

Organization windows_domain.

Source: Organization windows_domain.

EventData/SubjectLogonId

String Required

Fixed `0x3e7`.

Source: Fixed `0x3e7`.

EventData/TargetUserSid

String Required

Fixed `S-1-0-0`.

Source: Fixed `S-1-0-0`.

EventData/TargetUserName

String Required

Selected user username; local account-name grammar, Unicode supported.

Source: Selected user username; local account-name grammar, Unicode supported.

EventData/TargetDomainName

String Required

Reuse organization windows_domain.

Source: Reuse organization windows_domain.

EventData/Status

String Required

Fixed `0xc0000234`.

Source: Fixed `0xc0000234`.

EventData/FailureReason

String Required

Fixed `%%2307`.

Source: Fixed `%%2307`.

EventData/SubStatus

String Required

Fixed `0x0`.

Source: Fixed `0x0`.

EventData/LogonType

String Required

Fixed `2`.

Source: Fixed `2`.

EventData/LogonProcessName

String Required

Fixed `User32`.

Source: Fixed `User32`.

EventData/AuthenticationPackageName

String Required

Fixed `Negotiate`.

Source: Fixed `Negotiate`.

EventData/WorkstationName

String Required

Same device hostname.

Source: Same device hostname.

EventData/TransmittedServices

String Required

Fixed `-`.

Source: Fixed `-`.

EventData/LmPackageName

String Required

Fixed `-`.

Source: Fixed `-`.

EventData/KeyLength

String Required

Fixed `0`.

Source: Fixed `0`.

EventData/ProcessId

String Required

Fixed `0x1bc`.

Source: Fixed `0x1bc`.

EventData/ProcessName

String Required

Fixed `C:\Windows\System32\winlogon.exe`.

Source: Fixed `C:\Windows\System32\winlogon.exe`.

EventData/IpAddress

String Required

Fixed `127.0.0.1`.

Source: Fixed `127.0.0.1`.

EventData/IpPort

String Required

Fixed `0`.

Source: Fixed `0`.