How to Detect Suspicious Login Attempts on Windows

Issue Description 

Unauthorized login attempts can indicate compromised passwords or brute-force attacks. 

Common Causes 

• Weak passwords 

• Exposed credentials 

• Shared devices 

Step-by-Step Solution 

Step 1: Check Sign-In Activity 

• Open Settings → Accounts → Sign-in options 

• Review recent sign-in alerts (Microsoft accounts) 

 

Step 2: Review Event Logs 

• Press Windows + R → eventvwr.msc 

• Go to Windows Logs → Security 

• Look for Event ID 4625 (failed logins) 

 

Step 3: Enable Account Lockout 

• Open Local Security Policy → Account Policies 

• Set lockout after repeated failed attempts 

 

Step 4: Change Password Immediately 

• Use a strong, unique password 

• Sign out all devices 

Explore Further 

• Enable email alerts for login activity 

Prevention & Best Practices 

Never reuse Windows passwords elsewhere.