Error Code Lookup: AADSTS, NTSTATUS and Kerberos Codes
Paste a code, an error message or a whole event. Every Entra ID, NTSTATUS and Kerberos code in it is explained with Microsoft’s official wording — 2,091 codes in all — and linked to an investigator’s write-up where one exists. Nothing you paste leaves your browser.
What the lookup covers
- 350 Entra ID sign-in error codes (AADSTS…), from Microsoft’s
authentication and authorization error codes table.
They appear as
ResultTypein Sentinel’sSigninLogsand asstatus.errorCodein Graph exports. The AADSTS reference explains the security-relevant ones in depth, including whether the password was correct. - 1,673 NTSTATUS values from [MS-ERREF] — the Status and Sub Status of event 4625 and the Error Code of event 4776 when a logon fails, and any other Windows status besides. Windows logon failure codes covers the ones that matter in an investigation.
- 68 Kerberos failure codes, as listed in Microsoft’s event 4771 documentation — the Failure Code of 4771 and 4769 and the Result Code of 4768 on domain controllers. See Kerberos failure codes.
Paste the whole thing
You do not need to isolate the code. The lookup picks every code out of what you paste: an Entra error page, a 4625
event copied from Event Viewer (“Status: 0xC000006D Sub Status: 0xC000006A”), a Kerberos event, a line from a SIEM export
where the status is a signed decimal, or just the error name, such as IdsLocked or KDC_ERR_PREAUTH_FAILED.
A short hexadecimal value such as 0x18 is read as a Kerberos code when it stands alone or appears next to
Kerberos terms, so it is not confused with an offset in unrelated text. Anything that is not a code is treated as a word search
over the official descriptions — “locked”, “expired”, “conditional access”.
Reading the three families
An AADSTS code is Entra ID’s verdict on one sign-in attempt. The question an investigator asks first is whether the password was accepted before the failure: AADSTS50126 means it was not, while AADSTS50074 or AADSTS50076 mean it was and only multi-factor authentication stood in the way. An NTSTATUS code in a logon event answers the same question for Windows: 0xC000006A (wrong password for a real account) and 0xC0000064 (no such user) separate password guessing from user-name enumeration. A Kerberos code is the domain controller’s answer to a ticket request; 0x18 is a wrong password and 0x6 an unknown principal, and attacks that go through Kerberos never produce a 4625 on the target servers.
Questions
- Why does a Windows logon failure show two codes?
- Event 4625 carries a Status and a Sub Status. The Status is the general result, often 0xC000006D (logon failure), and the Sub Status says why: 0xC000006A means the account exists but the password was wrong, 0xC0000064 means the user name does not exist. Paste both and the lookup explains each one.
- My status code is a negative number. Is that the same code?
- Yes. NTSTATUS values are 32-bit, and tools that print them as signed integers show the failures as negative numbers: -1073741718 is 0xC000006A. The lookup converts signed and unsigned decimal values to the hexadecimal form Microsoft documents.
- What are values like %%2313 in the Failure Reason field?
- They are references into a Windows message file, which Event Viewer normally replaces with text such as "Unknown user name or bad password". They are not status codes. The Status and Sub Status fields of the same event carry the NTSTATUS codes this tool explains.
- Is what I paste sent anywhere?
- No. The page downloads Microsoft’s code tables once and does the matching in your browser. Whatever you paste — including user names or IP addresses inside an event — stays in the tab.
Find these codes across a whole log
The free browser analyzer groups failures by account, source and code across an entire Entra ID, Windows, auth.log, nginx, CloudTrail or Okta export — and flags password spraying, brute force that succeeded and MFA bypass. Nothing is uploaded.