Event ID 4625 Sub Status 0X0 Expand / Collapse
Author
Message
Posted 6/4/2019 5:12:15 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/16/2015 10:08:20 AM
Posts: 3, Visits: 0
I'm trying to get hopefully a very simple answer. When it comes to a failed login specifically 4625 what does the sub_status code 0x0 mean. Typically that code status for status ok but this is a FAILED login so it can't be ok. Also when you see sub_status 0x0 there is usually a status code telling you why it failed. So what is 0x) in this case?
Post #8565
Posted 6/5/2019 9:05:22 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/16/2015 10:08:20 AM
Posts: 3, Visits: 0
please note that this " Typically that code status for status ok" was suppose to read ...

Typically that code STANDS for status ok
Post #8566
Posted 6/24/2019 3:04:32 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
What is the value of the "Status:" Field?
Post #8578
Posted 7/24/2019 10:35:30 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/16/2015 10:08:20 AM
Posts: 3, Visits: 0
The status could be anything you would normally see for the sub_status. For the sake of discussion we'll use 0xC0000234. This is account locked out. This is a normal sub_status code and you will see 4625 messages using that sub_status so why throw in sub_status 0X0 and make 0xC0000234 the status ? Ultimately the question is why does 0X0 occur and what's it's meaning.
Post #8584
Posted 9/9/2019 2:07:26 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
My experience is that translating the status or substatus will tell you why it failed. I'm not positive myself why they choose to put the identifying code in status vs substatus.
Post #8590
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 6:18am