locked
Failure reasons eg: 2313 in ID 4625 RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello

    Do You have the list with descr of failure reasons eg. %%2313, %%2307... I've searched Net and nothing.. :(

    Mainly I see it in ID 4625.

    Thank you in advance for your help!

    Damiano

    Friday, February 28, 2014 2:03 PM

Answers

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    To know the failure reason of event 4625, status and sub-status can be used to identify that, please go through the below thread for more details:

    Where can I find the full list of Failure Reasons for event 4625?

    http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/where-can-i-find-the-full-list-of-failure-reasons/d0269426-2183-4d99-8af0-cc009dee6658

    Hope this helps.

    Regards,

    Yan Li

    Regards, Yan Li

    • Marked as answer by Yan Li_ Monday, March 10, 2014 8:51 AM
    Monday, March 3, 2014 6:35 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hello,

    I've hit the same wall trying to match the Failure Reason reported by querying InsertionString9 using VBScript calls.  I've seen a few posts referencing explanations for  the Status & Sub-status codes, but no posts matching Failure Reason codes to their text-based equivalents.

    Here are the ones I've managed to figure out.  In parentheses I've added the pre-Vista EventID

    • %%2305 The specified user account has expired. (532)
    • %%2309 The specified account's password has expired. (535)
    • %%2310 Account currently disabled. (531)
    • %%2311 Account logon time restriction violation. (530)
    • %%2312 User not allowed to logon at this computer. (533)
    • %%2313 Unknown user name or bad password. (529)

    I'm still trying to match these pre-Vista EventIDs with a numeric Failure Reason

    • (534) The user has not been granted the requested logon type at this machine.
    • (536) The NetLogon component is not active.
    • (537) The logon attempt failed for other reasons.
    • (539) Account locked out.

    I also tend to see a few 4625s with Failure Reason %%2304; An Error occurred during Logon.  The Status 0xC000005E for these matches to STATUS_NO_LOGON_SERVERS; There are currently no logon servers available to service the logon request.  These usually appear from Logon Type 11 when consent.exe is launched.  

    Maybe someone else can fill in the blanks, or better yet can provide a function call which would ask the local system to translate these codes into the text messages shown in Event Viewer. 

    Thanks,

    Steve

    Tuesday, July 22, 2014 4:56 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello

    Do You have the list with descr of failure reasons eg. %%2313, %%2307... I've searched Net and nothing.. :(

    Mainly I see it in ID 4625.

    Thank you in advance for your help!

    Damiano


    I have exactly this issue and try to solve it with powershell. any how to "convert" eG %%2313 to Unknown user name or bad password ?
    Thursday, February 8, 2018 3:20 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    %%2307 Account locked out
    Wednesday, July 29, 2020 10:29 PM