| Previous | Next |
| ERROR_PASSWORD_RESTRICTION | ERROR_ACCOUNT_RESTRICTION |
ERROR_LOGON_FAILURE
Windows rejected the supplied logon credentials or authentication exchange
A logon request passes through an authentication package and, on success, LSA creates a logon session and returns a token. ERROR_LOGON_FAILURE is the broad failure result when that process does not authenticate the principal. It should not automatically be interpreted as proof that the password was typed incorrectly: Windows authentication can involve Kerberos, NTLM, smart-card credentials, cached logon, and package-specific status information.
Start with the Security log failure event and its Status/SubStatus, Logon Type, Authentication Package, Workstation Name, and source network fields. Event 4625 is specifically designed to preserve the more detailed reason that may have been collapsed into a generic API error. Correlate the same timestamp with Kerberos, Netlogon, or package logs before resetting credentials. A successful name lookup only proves the account can be identified; it does not prove the credential or requested logon path can authenticate.
What to inspect
- Correlate the failure with security event 4625 Status and SubStatus.
- Record Logon Type and Authentication Package before testing another credential path.
- Check Kerberos or Netlogon events when the request involved a domain account.
References
- Microsoft: LsaLogonUser
- Microsoft: security event 4625
- Microsoft: Windows authentication credentials
Looking for a different code? Search another status or error code.