Forum

Ultimate Windows Security Forum » Security Log » 4625 - An account failed to log on » Confusion between Status and Substatus codes

Confusion between Status and Substatus codes Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
gurrapu.praveen
Posted 10/14/2011 7:52:52 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/27/2011 10:16:02 AM
Posts: 3, Visits: 2
Dear Randy,

In the encyclopedia article on the event 4625, the first column of the table says 'Status and Sub status codes'. But, Status and Substatus have different values. I have observed this for wrong password event on a Windows 2008 machine. Please refer to the attached screen shot.

The value of Status is 0xc000006d and Sub Status is 0xc000006a.

So, in the encyclopedia article, are your referring to Sub Status codes for all the cases?

 

Thanks,

Praveen

Post #822
RandyFranklinSmith
Posted 11/14/2011 8:39:59 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
the relation of status and substatus code has never been clear to me.  just go with the code that makes the most sense.  in this case 6a
Post #845
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:47am