Does 0xC000006A confirm the username is valid?

Yes. Windows records 0xC0000064 when the account does not exist, so 0xC000006A means the name matched a real account and only the password was wrong. For triage that separates attacks on real accounts from noise against guessed names, and it tells you which accounts an attacker is actually working on.

Why is Status 0xC000006D while Sub Status is 0xC000006A?

Status holds the general result — 0xC000006D, a bad username or authentication information — and Sub Status holds the specific reason. Always read Sub Status when Status is 0xC000006D; it is where 0xC000006A, 0xC0000064 and the account-state codes such as disabled or expired appear.

How many 0xC000006A failures should trigger an alert?

There is no universal number, but the shapes are reliable: ten or more failures for one account from one source within minutes is brute force, and one source failing for five or more different accounts in an hour is spraying. Service accounts deserve a lower threshold, as Microsoft's monitoring note says, because they should never mistype a password.

What if the failures come from one of our own servers?

Check the Logon Type and the Process Name in the event. Regular type 3 failures from an application server usually come from a scheduled task, service or mapped drive still using an old password after a reset; the timing is regular and the account recently changed its password. Failures from an internet-facing host or an unfamiliar address are an attack until shown otherwise.

0xC000006A: Windows Logon Failure — Wrong Password for a Real Account

Published October 6, 2026

The account exists and the password was wrong. One event is a typo; many against one account is brute force; one source failing across many real accounts is password spraying.

Did the attacker have the password? No — the password (or username) was wrong.

Microsoft's definition

STATUS_WRONG_PASSWORD

When trying to update a password, this return status indicates that the value provided as the current password is not correct.

Microsoft's 4625 monitoring note: "User logon with misspelled or bad password" for critical accounts or service accounts. Especially watch for a number of such events in a row.

Source: [MS-ERREF] NTSTATUS Values · checked against the published table on every build

Where it appears

Event 4625 (An account failed to log on): the Sub Status field, usually alongside Status 0xC000006D
Event 4776 (credential validation, NTLM) on domain controllers: the Error Code field
Microsoft Sentinel / Log Analytics: the SubStatus and Status columns of the SecurityEvent table

What it means

In event 4625 the Status field usually carries the general result 0xC000006D and the Sub Status carries the reason: 0xC000006A means the account was found and the password did not match. Microsoft’s NTSTATUS table words it from the password-change point of view, but in logon events it simply means “wrong password for an existing account.” Domain controllers record the same value as the Error Code of event 4776 when they validate NTLM credentials.

Two fields change how you read it: Logon Type (3 is network logon such as SMB — and also failed RDP attempts when Network Level Authentication is on; 10 is RemoteInteractive; 8 is NetworkCleartext, typical of basic authentication to IIS) and Source Network Address, the client the attempt came from.

Is it an attack?

Pattern	Reading
One account, a couple of failures, then a 4624 success from the same workstation	A typo
One account, failures every few minutes from one internal server	An old password stored in a service, task or mapped drive
One account, dozens of failures in minutes from one source	Brute force — expect a lockout (0xC0000234)
One source, failures across many real accounts	Password spraying
External source, logon type 3 or 10, admin-like account names	Internet-exposed RDP or SMB under attack

A spray usually mixes 0xC000006A (real accounts) with 0xC0000064 (guessed names that do not exist). The Windows 4625 password-spray rule is built on exactly that grouping.

How to investigate

Group wrong-password failures by source and see how many accounts each source touched:

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4625 and SubStatus =~ "0xc000006a"
| summarize Failures = count(), Accounts = dcount(TargetUserName),
            AccountList = make_set(TargetUserName, 20), LogonTypes = make_set(LogonType, 5)
    by IpAddress, Computer
| order by Failures desc

Then answer the only question that changes the severity — did any of those sources log on successfully afterwards?

let failures = SecurityEvent
    | where TimeGenerated > ago(1d) and EventID == 4625 and SubStatus =~ "0xc000006a"
    | summarize FailCount = count(), LastFail = max(TimeGenerated) by IpAddress, TargetUserName;
SecurityEvent
| where TimeGenerated > ago(1d) and EventID == 4624
| join kind=inner failures on IpAddress, TargetUserName
| where TimeGenerated > LastFail
| project TimeGenerated, Computer, TargetUserName, IpAddress, LogonType, FailCount

A success after failures from the same source is a compromise: disable or reset the account, isolate the source if it is internal, and review what the session did. Without a SIEM, export the Security log from Event Viewer as XML and load it into the free browser analyzer, which groups 4625 failures by source and Sub Status.

Related codes

0xC0000064 STATUS_NO_SUCH_USER Someone tried to log on with an account name that does not exist. Occasional typos are normal; bursts of invented names from one source are username guessing or spraying with a generic list.
0xC000006D STATUS_LOGON_FAILURE The logon was rejected as invalid without saying which half was wrong — it is the general failure result that event 4625 usually carries in Status, with the real reason in Sub Status.
0xC0000234 STATUS_ACCOUNT_LOCKED_OUT The account is locked because the lockout threshold was reached; every further attempt fails with this code until the lockout ends or an administrator unlocks it.
0xC0000072 STATUS_ACCOUNT_DISABLED
0xC000006E STATUS_ACCOUNT_RESTRICTION
0xC0000071 STATUS_PASSWORD_EXPIRED

Frequently Asked Questions

Does 0xC000006A confirm the username is valid?: Yes. Windows records 0xC0000064 when the account does not exist, so 0xC000006A means the name matched a real account and only the password was wrong. For triage that separates attacks on real accounts from noise against guessed names, and it tells you which accounts an attacker is actually working on.
Why is Status 0xC000006D while Sub Status is 0xC000006A?: Status holds the general result — 0xC000006D, a bad username or authentication information — and Sub Status holds the specific reason. Always read Sub Status when Status is 0xC000006D; it is where 0xC000006A, 0xC0000064 and the account-state codes such as disabled or expired appear.
How many 0xC000006A failures should trigger an alert?: There is no universal number, but the shapes are reliable: ten or more failures for one account from one source within minutes is brute force, and one source failing for five or more different accounts in an hour is spraying. Service accounts deserve a lower threshold, as Microsoft's monitoring note says, because they should never mistype a password.
What if the failures come from one of our own servers?: Check the Logon Type and the Process Name in the event. Regular type 3 failures from an application server usually come from a scheduled task, service or mapped drive still using an old password after a reset; the timing is regular and the account recently changed its password. Failures from an internet-facing host or an unfamiliar address are an attack until shown otherwise.

Find 0xC000006A in your own logs

Load a Windows Security event export into the free browser analyzer to group failures by account, source IP and status code (nothing is uploaded), or run it through LogTriage for threat-intel enrichment and an AI-written incident report.

Open the free analyzer → Analyze Your Own Logs