PowerShell: Find Failed Login Attempts in Event Log
Need to check for failed login attempts - for security auditing or investigating a potential brute-force attempt? This one-liner searches the Security log directly for the relevant event.
Prerequisites:
- Privileges: Run as Administrator
- Module: Built-in, no import needed
Quick Command:
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 5Example Output:
Get-WinEvent : No events were found that match the specified selection criteria.An empty result (or this error) simply means no failed login attempts have been logged recently - it's not an indication the command is broken.
📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-WinEvent -FilterHashtable filters the Security log for a specific Event ID instead of returning everything, which is far more efficient than pulling all events and filtering afterward.
- Id=4625 is the specific Windows Event ID for a failed logon attempt - one of the most commonly monitored security events.
- -MaxEvents 5 limits the output to the 5 most recent matches, since a system under attack could otherwise return thousands of entries.