Correlate failed and successful sign-ins
On a canned Security log for one Windows 11 practice host, open event 4625 for the failed sign-in and then event 4624 for the successful sign-in by Marcus.Lee. This establishes the failed-then-successful sequence on this host as a correlation lead. The event descriptions show a source network address and workstation name, which you may read to find the originating host, but that is not WHO was at the host and the sequence does not prove the account was compromised. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.
Steps
- 1
Open the Security log, then open event ID 4625 for Marcus.Lee and confirm that it records a failed sign-in caused by a bad password.
- 2
Open event ID 4624 for Marcus.Lee and confirm that it records the successful sign-in that followed the failure.
What you should see
Security event 4625 for Marcus.Lee is opened first, followed by Security event 4624 for the same account. The pair establishes a failed-then-successful sign-in on this host, not the source host or a compromise verdict.