> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Find Failed Login Attempts in Event Log
- URL: https://www.filipkonopik.com/powershell-find-failed-login-attempts-in-event-log/
- Published: 2026-07-26T17:15:04.000Z
- Updated: 2026-08-06T05:40:00.000Z
- Author: Filip Konopík
- Tags: Event Logs & Monitoring

Need to check for failed login attempts - for security auditing or investigating a potential brute-force attempt? This one-liner searches the Security log directly for the relevant event.

Prerequisites:

- Privileges: Run as Administrator
- Module: Built-in, no import needed

Quick Command:

```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 5
```

Example Output:

```powershell
Get-WinEvent : No events were found that match the specified selection criteria.
```

An empty result (or this error) simply means no failed login attempts have been logged recently - it's not an indication the command is broken.

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- Get-WinEvent -FilterHashtable filters the Security log for a specific Event ID instead of returning everything, which is far more efficient than pulling all events and filtering afterward.
- Id=4625 is the specific Windows Event ID for a failed logon attempt - one of the most commonly monitored security events.
- \-MaxEvents 5 limits the output to the 5 most recent matches, since a system under attack could otherwise return thousands of entries.