Windows event logs for sign-in and update failures
For desktop support and service desk technicians who already know their way around Event Viewer and the basics of Windows Update (see 'Event Viewer and Reliability Monitor' and 'Windows Update troubleshooting') and now need to answer two common questions from the logs: why did this sign-in fail, and why did this update fail? You'll work out which computer and log record a failed sign-in, read 4625 Status and Sub Status codes and logon types, follow 4771 failure codes and 4740 lockouts back to the device causing them, find the cause of a failed update from WindowsUpdateClient events, WindowsUpdate.log and CBS.log, and write a ticket note that keeps passwords and unnecessary personal data out. Grounded in Microsoft Learn's event reference and Windows Update documentation. Read Security logs only on systems you're authorised to investigate. Ends with a supervisor-graded log investigation.
- Level
- Intermediate
- Length
- About 100 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Identify which computer and log record a failed sign-in from the logon type and authentication protocol
- Interpret 4625 Status and Sub Status codes to name why a Windows sign-in failed
- Interpret 4771 failure codes and 4740 lockout events to trace a domain sign-in failure to its source
- Find the cause of a failed Windows update from WindowsUpdateClient events, WindowsUpdate.log and CBS.log
- Write a ticket note that records the event evidence, cause and next step without exposing credentials or personal data
Course outline
- 1.Identify which computer and log record a failed sign-inLesson · 16 min
- 2.Interpret 4625 Status and Sub Status codesLesson · 16 min
- 3.Interpret 4771 failure codes and 4740 lockouts to trace a domain sign-in failureLesson · 15 min
- 4.Find the cause of a failed Windows update from events and logsLesson · 16 min
- 5.Write a ticket note that records the evidence, cause and next step safelyLesson · 12 min
- 6.Windows event logs for sign-in and update failures: knowledge checkKnowledge check · 14 questions
- 7.Windows event logs for sign-in and update failures: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- Microsoft Learn: Audit Logon (where logon events are generated)
- Microsoft Learn: 4624(S) An account was successfully logged on
- Microsoft Learn: 4625(F) An account failed to log on (logon types, Status and Sub Status values)
- Microsoft Learn: 4771(F) Kerberos pre-authentication failed (failure codes)
- Microsoft Learn: 4776(S, F) The computer attempted to validate the credentials for an account (NTLM error codes)
- Microsoft Learn: 4740(S) A user account was locked out (Caller Computer Name)
- Microsoft Learn: Windows Update log files
- Microsoft Learn: Windows Update common errors and mitigation
- Microsoft Learn: Fix Windows Update corruptions and installation failures (error code table, DISM)
- Microsoft Learn: Troubleshoot Windows Update error 0x80070002 (event 20 sample, CBS log)
- Microsoft Learn: Troubleshoot Windows Update error code 0x80070070 (disk space, Operational log)
- Microsoft Learn: Get-WinEvent (FilterHashtable queries)
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.