Windows Failed Log On Event ID [Fix]

If you recently opened Event Viewer on your Windows PC and noticed errors like Event ID 4625, 4624, 4137, 4132, 4133, 4134, or 4131, you’re probably wondering what’s going on. At first glance, these security logs can look pretty scary, especially when they keep appearing over and over again.

In most cases, these Windows Event IDs are related to failed sign-in attempts, authentication issues, network login problems, saved passwords, or Windows security services. Sometimes the issue is as simple as an outdated password stored somewhere in Windows. Other times, it may happen because of corrupted system files, account issues, or apps trying to connect with old credentials in the background.

In this guide, you’ll learn what these Event IDs mean and how to fix them step by step on Windows 11 and Windows 10.

Table of Contents

What Do These Windows Event IDs Mean?

First of all, let’s understand what these Event IDs actually mean.

Event ID 4625 usually means a failed login attempt. Windows records this event whenever a user, app, or service tries to sign in with incorrect credentials.

Event ID 4624 is the opposite. It shows a successful login event. You’ll often see this appear together with Event ID 4625 when Windows is repeatedly trying to authenticate something.

The other Event IDs, like 4131, 4132, 4133, 4134, and 4137, are generally connected to Windows authentication services, Kerberos tickets, account validation, or network security communication.

These events can appear because of:

Incorrect passwords
Expired credentials
Corrupted Windows files
Network authentication issues
Domain login problems
Broken user profiles
Background apps using old passwords
Security software conflicts

Sometimes these logs are completely harmless. But if they appear constantly or are causing sign-in problems, they should definitely be fixed.

Windows Failed Log On Event ID 4625, 4624, 4137, 4132, 4133, 4134, 4131 [Fix]

To fix Windows Failed Log On Event IDs 4625, 4624, 4137, 4132, 4133, 4134, and 4131, open Event Viewer and check which account or app is causing the failed login attempts. Then remove outdated saved passwords from Credential Manager, run SFC and DISM scans, restart Windows authentication services, update Windows, and scan your PC for malware. If the issue still continues, reset security policies or create a new Windows user account.

Let’s go through the complete process!

Step 1: Open Event Viewer and Check What Is Triggering the Error

The first thing you should do is figure out exactly what is causing the failed logon event. This makes troubleshooting much easier.

Press Windows + X and click Event Viewer. You can also open the Start menu, type Event Viewer, and launch it from there. Once the window opens, expand Windows Logs from the left side and click Security.

Now look for events with IDs like:

4625
4624
4131
4132
4133
4134
4137

Double-click one of the events to open it.

Inside the details section, pay attention to things like:

Account Name
Failure Reason
Logon Type
Source Network Address
Process Name

This information helps you understand what is actually failing.

For example, if you notice the same username appearing repeatedly, there’s a good chance Windows or an app is trying to sign in using an old password.

If the failed logins are coming from an unknown IP address, it could be an unauthorized access attempt.

Taking a few minutes to check these details can save you a lot of time later.

Step 2: Make Sure Your Windows Password Is Correct

One of the most common reasons behind Event ID 4625 is simply an incorrect password.

This often happens after changing your Microsoft account password or local account password. Windows services and apps may still be using the older saved credentials in the background.

Start by restarting your PC and manually signing in with your current password.

If you use a Microsoft account, try signing in to your account online to confirm that the password is working correctly.

You should also check whether your account is locked or disabled.

Press Windows + R, type: lusrmgr.msc, then press Enter.

Open the Users folder and double-click your account. Make sure options like ‘Account is disabled ‘ or ‘Account is locked out’ are not checked.

If your computer belongs to a work or school network, you may need to contact the system administrator to verify your account permissions.

Step 3: Remove Old Passwords from Credential Manager

Windows stores saved usernames and passwords inside something called Credential Manager. If outdated credentials are stored there, Windows may continue trying to sign in with the wrong password repeatedly.

To check this, open the Start menu and search for: Credential Manager. Click Windows Credentials.

You’ll now see a list of saved login details connected to apps, websites, shared folders, and Microsoft services.

Look for old or suspicious entries related to:

Microsoft accounts
Outlook
OneDrive
VPN apps
Remote Desktop
Shared network drives
Office apps

If you see credentials you no longer use, remove them. After that, restart your PC.

Once Windows starts again, it will usually ask for updated login information automatically.

This step alone fixes failed logon events for a lot of users.

Step 4: Repair Corrupted Windows System Files

Sometimes Windows authentication services stop working correctly because important system files are damaged or missing.

Thankfully, Windows includes built-in repair tools that can automatically scan and fix these problems.

Open the Start menu, type: Command Prompt
Right-click it and choose Run as administrator.
Now enter this command: sfc /scannow
Press Enter and wait for the scan to finish.

The System File Checker tool scans protected Windows files and repairs corrupted ones automatically.

After the scan completes, run these DISM commands one by one:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

These commands repair the Windows image itself and fix deeper corruption problems.

Once everything finishes, restart your computer and check whether the Event Viewer errors continue.

Step 5: Restart Important Windows Authentication Services

Windows relies on several background services for login authentication and security communication. If one of these services stops responding properly, authentication-related Event IDs may appear.

Press Windows + R, type: services.msc, then press Enter.

Now locate these services:

Credential Manager
Windows Event Log
Remote Procedure Call (RPC)
Workstation
Netlogon
Windows Time

Right-click each service and choose Restart. Also, make sure their startup type is set to Automatic.

The Netlogon service is especially important on domain-connected computers because it handles domain authentication requests.

Restarting these services can often clear temporary authentication glitches immediately.

Step 6: Scan Your PC for Malware or Suspicious Activity

If failed logon events keep appearing nonstop, there’s always a chance that malware or unauthorized access attempts may be involved.

Open Windows Security and go to: Virus & threat protection. Choose Full Scan and let Windows scan the entire system.

If you want a deeper scan, use Microsoft Defender Offline Scan. This scans your PC before Windows fully loads, making it easier to detect hidden threats.

You should also look for suspicious login attempts inside the Event Viewer.

Warning signs include:

Repeated login failures every few seconds
Unknown usernames
Unknown IP addresses
Remote login attempts while your PC is idle

If you notice anything suspicious, immediately:

Change your Windows password
Change your Microsoft account password
Enable two-factor authentication
Disable unused remote access features
Update your antivirus software

This is especially important if you use Remote Desktop Protocol (RDP) or remote access apps.

Step 7: Install the Latest Windows Updates

Outdated Windows components can sometimes cause authentication bugs and security-related Event Viewer errors.

To update your PC, open: Settings > Windows Update

Click: Check for updates

Install everything available, including:

Security updates
Cumulative updates
Driver updates
.NET Framework updates
Feature updates
After installation, restart your computer.

Microsoft regularly releases fixes for Windows authentication services, login systems, and security protocols, so staying updated is important.

Step 8: Reset Windows Security Policies

Incorrect security settings can also trigger failed logon events.

Press Windows + R, type: secpol.msc. Then press Enter. Next, go to: Local Policies > Security Options

Carefully review settings related to:

Account lockout policies
Network security
Authentication levels
User rights assignments

If you previously changed advanced security settings manually, resetting them to the default can help. You can also reset security policies through Command Prompt.

Open Command Prompt as administrator and run:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

After the process finishes, restart your PC.

This restores Windows security policies to their default state.

Step 9: Create a New Windows User Account

Sometimes the issue is caused by a corrupted Windows user profile.

A quick way to test this is by creating a brand new user account.

Go to: Settings > Accounts > Other users
Click: Add account
Choose: I don’t have this person’s sign-in information
Then select: Add a user without a Microsoft account
Create a temporary account and give it administrator permissions.
Now restart your computer and sign in to the new account.

If the Event Viewer errors disappear, your old Windows profile is likely corrupted.

At that point, you can move your files to the new profile and continue using it normally.

Step 10: Disable Problematic Startup Apps

Some apps continue to run in the background and repeatedly try to sign in with outdated credentials.

This is very common with: Cloud storage apps, Email clients, VPN software, Backup tools, Remote access programs

Press: Ctrl + Shift + Esc
Open the Startup Apps section.
Disable unnecessary startup programs temporarily.
You can also press Windows + R, type: msconfig
Go to the Services tab and check: Hide all Microsoft services

Please disable the suspicious third-party services temporarily and restart your PC.

If the failed login events stop afterward, you’ve probably found the app causing the issue.

FAQs

Is Event ID 4625 a virus?

No, Event ID 4625 itself is not a virus. It simply means a login attempt failed. However, repeated unknown login attempts could indicate malware or unauthorized access activity.

What causes Windows failed logon events?

The most common causes include incorrect passwords, outdated saved credentials, corrupted system files, broken user accounts, network authentication problems, or third-party apps using old login information.

Can I safely ignore Event ID 4624?

Yes, in most cases. Event ID 4624 is a successful login event and is usually informational only.

Why do these errors keep coming back?

Usually because an app, service, or background process is repeatedly trying to sign in using incorrect credentials.

Does resetting Windows fix these Event IDs?

Yes, but it should only be considered as a last resort after trying all other troubleshooting steps first.