SH-Deployer/apps/Splunk_TA_windows/lookups/windows_signatures_substatus_850.csv

1	signature_id	Sub_Status	signature
2	4625	0xc0000064	User logon with misspelled or bad user account
3	4625	0xC0000064	User logon with misspelled or bad user account
4	4625	0xc000006a	User logon with misspelled or bad password
5	4625	0xC000006A	User logon with misspelled or bad password
6	4625	0xc0000234	User logon with account locked
7	4625	0xC0000234	User logon with account locked
8	4625	0xc0000072	User logon to account disabled by administrator
9	4625	0xC0000072	User logon to account disabled by administrator
10	4625	0xc000006f	User logon outside authorized hours
11	4625	0xC000006F	User logon outside authorized hours
12	4625	0xc0000070	User logon from unauthorized workstation
13	4625	0xC0000070	User logon from unauthorized workstation
14	4625	0xc0000193	User logon with expired account
15	4625	0xC0000193	User logon with expired account
16	4625	0xc0000071	User logon with expired password
17	4625	0xC0000071	User logon with expired password
18	4625	0xc0000133	Clocks between DC and other computer too far out of sync
19	4625	0xC0000133	Clocks between DC and other computer too far out of sync
20	4625	0xc0000224	User is required to change password at next logon
21	4625	0xC0000224	User is required to change password at next logon
22	4625	0xc0000225	Evidently a bug in Windows and not a risk
23	4625	0xC0000225	Evidently a bug in Windows and not a risk
24	4625	0xc000005e	There are currently no logon servers available to service the logon request
25	4625	0xC000005E	There are currently no logon servers available to service the logon request
26	4625	0xc000006d	The cause is either a bad username or authentication information
27	4625	0xC000006D	The cause is either a bad username or authentication information
28	4625	0xc000006e	Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
29	4625	0xC000006E	Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions)
30	4625	0xc00000dc	Indicates the Sam Server was in the wrong state to perform the desired operation
31	4625	0xC00000DC	Indicates the Sam Server was in the wrong state to perform the desired operation
32	4625	0xc000015b	The user has not been granted the requested logon type (also called the logon right) at this machine
33	4625	0xC000015B	The user has not been granted the requested logon type (also called the logon right) at this machine
34	4625	0xc000018c	The logon request failed because the trust relationship between the primary domain and the trusted domain failed
35	4625	0xC000018C	The logon request failed because the trust relationship between the primary domain and the trusted domain failed
36	4625	0xc0000192	An attempt was made to logon, but the Netlogon service was not started
37	4625	0xC0000192	An attempt was made to logon, but the Netlogon service was not started
38	4625	0xc00002ee	Failure Reason: An Error occurred during Logon
39	4625	0xC00002EE	Failure Reason: An Error occurred during Logon
40	4625	0xc0000413	Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine
41	4625	0xC0000413	Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine