Windows Security Log Event ID 4825

Operating Systems Windows 2016 and 10
Windows Server 2019 and 2022
Category
 • Subcategory		System
 • Other System Events
Type Success
Corresponding events
in Windows 2003
and before		  

4825: A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group

On this page

We have not yet seen this event

Free Security Log Resources by Randy

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 4825

A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group.

Subject:
User Name: %1
Domain: %2
Logon ID: %3

Additional Information:
Client Address: %4


This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop."

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection

Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
Additional Resources