Monitoring Windows Event IDs: Unsuccessful Logins, Unlocks, and Startups in Windows 11
Windows event logs are a valuable resource for system administrators and security professionals to monitor and troubleshoot various system activities. In this article, we will focus on three specific types of events in Windows 11: unsuccessful logins, unlocks, and startups. We will discuss the relevant Event IDs, their causes, and how to monitor and analyze them.
Unsuccessful Logins
Unsuccessful logins can indicate various issues, such as incorrect passwords, user account lockouts, or brute-force attacks. In Windows 11, unsuccessful login events are logged under the "Security" event log category, with Event ID 4625.
4625
0
0
12544
0
0x8010000000000000
123456
Security
MyComputer
user1
MyDomain
0x1234567890
user2
MyDomain
0xC000006A
%%2313
In the above example, the Event ID 4625 indicates an unsuccessful login attempt. The "FailureReason" data field (%%2313) corresponds to "The user name or password is incorrect."
Unlocks
Unlock events are generated when a user unlocks a workstation after it has been locked. In Windows 11, unlock events are logged under the "Security" event log category, with Event ID 4801.
4801
0
0
12545
0
0x8020000000000000
123456
Security
MyComputer
user1
MyDomain
0x1234567890
user1
MyDomain
In the above example, the Event ID 4801 indicates a successful unlock event.
Startups
Startup events are generated when a user logs into a system, and the system starts various services and processes. In Windows 11, startup events are logged under the "System" event log category, with Event ID 12.
12
0
4
63
0
0x8000000000000000
123456
System
MyComputer
0
0
0
0
In the above example, the Event ID 12 indicates a system startup event.
Monitoring and Analyzing Event Logs
To monitor and analyze event logs, you can use the built-in Event Viewer tool in Windows 11. Additionally, you can use third-party tools such as Splunk, ELK Stack, or Nagios to collect, analyze, and alert on specific events.
References
- Microsoft Docs: Event ID 4625: An account failed to log on
- Microsoft Docs: Event ID 4801: A workstation was unlocked
- Microsoft Docs: Event ID 12: System startup
- Microsoft Docs: Basic Audit Policy Settings
- Splunk: Monitoring Windows Event Logs with Splunk
- ELK Stack: Configuring Windows Event Logs
- Nagios: Nagios Event Log Plugin
This article provided an overview of monitoring Windows Event IDs related to unsuccessful logins, unlocks, and startups in Windows 11. By understanding these events and their causes, you can better monitor and secure your Windows 11 environment.