What 0xc000006a – User Logon Misspelled or Bad Password

				
					function Get-Event4625Details {
    param (
        [Parameter(Mandatory=$true)]
        [int]$Number
    )

    # Define the status code descriptions
    $StatusDescriptions = @{
        "0XC000005E" = "There are currently no logon servers available to service the logon request."
        "0xC0000064" = "User logon with misspelled or bad user account"
        "0xC000006A" = "User logon with misspelled or bad password"
        "0XC000006D" = "This is either due to a bad username or authentication information"
        "0xC000006F" = "User logon outside authorized hours"
        "0xC0000070" = "User logon from unauthorized workstation"
        "0xC0000072" = "User logon to account disabled by administrator"
        "0XC000015B" = "The user has not been granted the requested logon type (aka logon right) at this machine"
        "0XC0000192" = "An attempt was made to logon, but the Netlogon service was not started"
        "0xC0000193" = "User logon with expired account"
        "0XC0000413" = "Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine"
    }

    # Define the LogonType descriptions
    $LogonTypeDescriptions = @{
        2 = "A user logged on to this computer."
        3 = "A user or computer logged on to this computer from the network."
        4 = "Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention."
        5 = "A service was started by the Service Control Manager."
        7 = "This workstation was unlocked."
        8 = "A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext)."
        9 = "A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections."
        10 = "A user logged on to this computer remotely using Terminal Services or Remote Desktop."
        11 = "A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials."
    }

    # Get Event ID 4625
    # $Number = 1
    $events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625} -MaxEvents $Number

    # $eventXml = [xml]$events.ToXml() 

    # Extract the required properties and add status descriptions
    $finalresult = $events | ForEach-Object {
        $eventXml = [xml]$_.ToXml()
        $eventData = $eventXml.Event.EventData.Data

        $status = $eventData[7].'#text'
        $subStatus = $eventData[9].'#text'
        $LogonType = [int]$eventData[10].'#text' # Cast to integer

        [PSCustomObject]@{
            "Account Name" = $eventData[5].'#text'
            "Account Domain" = $eventData[6].'#text'
            "Workstation Name" = $eventData[13].'#text'
            "Source IP Address" = $eventData[19].'#text'
            "Source Port" = $eventData[20].'#text'
            "Logon Type" = $LogonType
            "Logon Type Description" = $LogonTypeDescriptions[$LogonType]
            "Status Code" = $status
            "Status Description" = $StatusDescriptions[$status]
            "Sub Status Code" = $subStatus
            "Sub Status Description" = $StatusDescriptions[$subStatus]
        }
    }

    # Output the final result 
    $finalresult | Format-Table "Account Name", "Account Domain", "Workstation Name", "Source IP Address", "Source Port", `
                   "Logon Type", "Logon Type Description", "Status Code", "Status Description", "Sub Status Code", "Sub Status Description" `
                   -Wrap -AutoSize
}