How can you get the failed logon in windows 10

Question

I have heard that you can get the failed logons on a windows device in your logbooks. But how can you do that? I have searched around in the logbooks but nothing found. Secondly can you filter that by failed or succeed logins? I use windows 10 home edition.

Thanks in advance.

Answer 1

Yes it is possible. But first you have to enable it in your group policy.

1. Press Win + R and enter gpedit.msc (folowed by pressing return)
2. Click through the following tree:

   Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy

3. On the right panel double-click Audit logon events
4. Mark Success and Failure (if you want both to be logged)
5. Confirm those settings by pressing the OK button

You can now find your Audit Failure and Success entries in your eventviewer:

1. Press Win + R and enter eventvwr (followed by pressing return)
2. Open the Windows Logs Tree and click on Security

There you will find all entries.

You can also create a filter to only show your successful and failed logon attempts:

1. On the eventviewer click on Filter Current Log...
2. Change <All event IDs> to 4624,4625

The eventID 4624 shows your successful attempts, thereas 4625 shows the failed ones.

Remember: you will only find those attempts being logged since you've changed the group policy! So you can't see it for the past.

Answer 2

The steps above are correct. I added a task on Event 4625 (failure) by right clicking on Event 4625 in the Event Viewer "Attach Task To This Event..."

I made a batch file called "Event-ID-4625.bat" with following: @echo off start /max %SystemRoot%\system32\notepad.exe "C:\Event-ID-4625.txt"

It opens a file called "Event-ID-4625.txt" with the following text: Someone has had a logon failure, for auditing previously setup in GPEDIT go to... Event Viewer Custom Views->GP_Logon Failure https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ How can you get the failed logon in windows 10