Monitoring Windows Event IDs for security and system health requires tracking specific numeric codes in the Security log. Successful monitoring of unsuccessful logins, account unlocks, and system startups allows administrators to detect brute-force attacks, identify locked-out accounts, and verify boot integrity. This guide details the precise Event IDs for Windows 11 and provides automated PowerShell methods to extract these critical logs efficiently.
Understanding Critical Event IDs
Windows uses a structured logging system where every significant action is assigned a unique Event ID. To effectively monitor your system, you must understand which IDs correspond to the events you wish to track. The Security log within the Windows Event Viewer is the primary repository for these records.
For unsuccessful login attempts, the most critical identifier is Event ID 4625. This event is generated whenever a user or service fails to authenticate against the local machine or a domain controller. Monitoring this ID helps identify potential brute-force attacks or misconfigured services attempting to access resources with invalid credentials. Each instance provides valuable data such as the source IP address, the target username, and the specific failure reason code.
When an account becomes locked due to too many failed attempts, Windows generates Event ID 4740. This "Account Lockout" event is crucial for security teams because it indicates that an automated script or malicious actor has triggered the lockout policy. By tracking this ID, administrators can quickly identify the source of the lockout request and determine if it stems from a legitimate user error or a targeted attack.
System startup events are tracked differently than security events. Event ID 6005 indicates that the Event Log service was started, which typically happens during a normal system boot. Conversely, Event ID 6006 signifies a clean shutdown. While these do not indicate errors, they are essential for verifying that the system has started correctly after maintenance windows or unexpected power losses. For more advanced monitoring techniques, you might also want to explore
Monitoring Windows Event IDs for Unsuccessful Logins, Unlocks, and Startups in Windows 11 for deeper context on log aggregation strategies.
Enabling and Accessing the Security Log
Before you can monitor these events, you must ensure that auditing policies are enabled and that you have access to the Security log. In Windows 11, the Security log is not always populated by default for all actions unless specific Group Policy settings are configured.
First, open the Local Group Policy Editor by searching for "gpedit.msc" in the Start menu. Navigate to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff. Here, you should enable both "Audit Logon" and "Audit Other Logon/Logoff Events." This ensures that the system records detailed information about authentication attempts, including failures.
Once auditing is enabled, you can view the logs by opening the Event Viewer application. Expand the "Windows Logs" section in the left-hand pane and select "Security." You may need administrative privileges to view certain entries. If the log appears empty, verify that the auditing policy was applied successfully by running
gpresult /r in the command prompt to check current group policy assignments.
Automating Monitoring with PowerShell
Manually checking the Event Viewer for specific IDs is inefficient for large-scale monitoring. PowerShell provides a robust way to query these logs programmatically. You can use the
Get-WinEvent cmdlet to filter events based on their ID and time range.
To retrieve recent unsuccessful login attempts, use the following command structure:
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
ID = 4625
StartTime = (Get-Date).AddDays(-1)
} | Select-Object TimeCreated, Message
This command filters the Security log for Event ID 4625 occurring within the last 24 hours. The output displays the timestamp and the detailed message, which includes the username and source IP. For account lockouts, simply replace the ID with 4740. To monitor startups, query Event ID 6005 in the System log instead of the Security log by changing the
LogName parameter to
'System'.
You can export these results to a CSV file for further analysis using the
Export-Csv cmdlet. This approach allows you to integrate log monitoring into existing IT workflows or alerting systems without relying solely on the graphical interface.
Interpreting Results and Taking Action
Once you have retrieved the relevant events, interpreting them correctly is key to maintaining security. For Event ID 4625, pay attention to the "Failure Code" field. Codes like 0xC000006D indicate invalid usernames or passwords, while 0xC000006E suggests the account does not exist. High volumes of 0xC000006D errors from a single IP address strongly suggest a password spraying attack.
For Event ID 4740, identify the "Caller Computer Name" to determine which machine initiated the lockout. This could be a compromised workstation or a server with a stale credential cache. Immediate investigation is required to prevent further disruption or data loss.
Startup events like 6005 should be correlated with scheduled maintenance or patching windows. If a 6005 event appears at an unexpected time, it may indicate unauthorized reboots or system instability. Regularly reviewing these logs ensures that your Windows 11 environment remains secure and stable. For related troubleshooting on system performance, consider reading about
Scheduling a Task to Start a Batch File with Windows Task Scheduler to automate routine checks.
Frequently Asked Questions
How do I find the Security log if it is hidden?
The Security log is usually visible by default in Event Viewer, but if it is missing, ensure that the Windows Event Log service is running. Restarting the service via Services.msc often restores visibility to the log entries.
Can I receive email alerts for Event ID 4625?
Yes, you can create a custom subscription in Event Viewer that triggers a task when a specific event occurs. This task can execute a PowerShell script that sends an email notification using the
Send-MailMessage cmdlet.
What is the difference between Event ID 4625 and 4771?
Event ID 4625 logs general logon failures across various protocols, while 4771 specifically logs Kerberos pre-authentication failures. Both indicate authentication issues, but 4771 is more specific to domain environments using Kerberos.
Why are my startup events missing from the log?
If Event ID 6005 is missing, check if the Event Log service was stopped before the shutdown occurred. Additionally, ensure that no third-party software is interfering with the standard logging process or clearing logs prematurely.
Is it safe to delete old security events manually?
Deleting events manually is generally discouraged as it removes audit trails required for compliance. Instead, configure log retention policies in Group Policy to automatically archive or overwrite old events after a set period.