Answered by:
Failure reasons eg: 2313 in ID 4625

Question
-
Hello
Do You have the list with descr of failure reasons eg. %%2313, %%2307... I've searched Net and nothing.. :(
Mainly I see it in ID 4625.
Thank you in advance for your help!
Damiano
Friday, February 28, 2014 2:03 PM
Answers
-
Hi,
To know the failure reason of event 4625, status and sub-status can be used to identify that, please go through the below thread for more details:
Where can I find the full list of Failure Reasons for event 4625?
Hope this helps.
Regards,
Yan Li
Regards, Yan Li
- Marked as answer by Yan Li_ Monday, March 10, 2014 8:51 AM
Monday, March 3, 2014 6:35 AM
All replies
-
Hi,
To know the failure reason of event 4625, status and sub-status can be used to identify that, please go through the below thread for more details:
Where can I find the full list of Failure Reasons for event 4625?
Hope this helps.
Regards,
Yan Li
Regards, Yan Li
- Marked as answer by Yan Li_ Monday, March 10, 2014 8:51 AM
Monday, March 3, 2014 6:35 AM -
Hello,
I've hit the same wall trying to match the Failure Reason reported by querying InsertionString9 using VBScript calls. I've seen a few posts referencing explanations for the Status & Sub-status codes, but no posts matching Failure Reason codes to their text-based equivalents.
Here are the ones I've managed to figure out. In parentheses I've added the pre-Vista EventID
- %%2305 The specified user account has expired. (532)
- %%2309 The specified account's password has expired. (535)
- %%2310 Account currently disabled. (531)
- %%2311 Account logon time restriction violation. (530)
- %%2312 User not allowed to logon at this computer. (533)
- %%2313 Unknown user name or bad password. (529)
I'm still trying to match these pre-Vista EventIDs with a numeric Failure Reason
- (534) The user has not been granted the requested logon type at this machine.
- (536) The NetLogon component is not active.
- (537) The logon attempt failed for other reasons.
- (539) Account locked out.
I also tend to see a few 4625s with Failure Reason %%2304; An Error occurred during Logon. The Status 0xC000005E for these matches to STATUS_NO_LOGON_SERVERS; There are currently no logon servers available to service the logon request. These usually appear from Logon Type 11 when consent.exe is launched.
Maybe someone else can fill in the blanks, or better yet can provide a function call which would ask the local system to translate these codes into the text messages shown in Event Viewer.
Thanks,
Steve
Tuesday, July 22, 2014 4:56 PM -
Hello
Do You have the list with descr of failure reasons eg. %%2313, %%2307... I've searched Net and nothing.. :(
Mainly I see it in ID 4625.
Thank you in advance for your help!
Damiano
I have exactly this issue and try to solve it with powershell. any how to "convert" eG %%2313 to Unknown user name or bad password ?Thursday, February 8, 2018 3:20 PM -
%%2307 Account locked outWednesday, July 29, 2020 10:29 PM