4825 Security log · Logon/Logoff medium severity medium volume

Windows Event ID 4825 — A user was denied the access to Remote Desktop

RDP access denied (not for NPS/RADIUS — this is direct DC-based RDP deny). AccountName and ClientAddress are key.

Why event 4825 matters

RDP access denials from external IPs indicate brute force or unauthorized access attempts. High volume from single IP = automated attack.

How to detect it

Alert: >5 RDP denials from single ClientAddress. Alert: admin accounts denied on servers they should not be accessing.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Brute Force (T1110)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4825   // A user was denied the access to Remote Desktop
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4825
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A user was denied the access to Remote Desktop — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4825 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4800 The workstation was locked

Frequently asked questions

What is Windows Event ID 4825?

A user was denied the access to Remote Desktop. RDP access denied (not for NPS/RADIUS — this is direct DC-based RDP deny). AccountName and ClientAddress are key.

Which log records event 4825?

Event 4825 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4825?

Event 4825 is associated with: Brute Force (T1110).

How do you detect activity around event 4825?

Alert: >5 RDP denials from single ClientAddress. Alert: admin accounts denied on servers they should not be accessing.