TABLE 1: Authentication Failure and Error Codes
NTLM authentication error codes that event ID 680 and event 681 log
Error Code	Cause
3221225572	User logon with misspelled or bad user account
3221225578	User logon with misspelled or bad password
3221225583	User logon outside authorized hours
3221225584	User logon from unauthorized workstation
3221225585	User logon with expired password
3221225586	User logon to account disabled by administrator
3221225875	User logon with expired account
3221226020	User logon with Change Password at Next Logon flagged
3221226036	User logon with account locked
Kerberos authentication error codes that event ID 675 and event ID 676 log
Error Code	Cause
0x6	The username doesn't exist.
0x12	Workstation restriction; logon time restriction; account disabled, expired, or locked out.
0x17	The user's password has expired.
0x18	The username is correct, but the password is wrong.
0x25	The workstation's clock is too far out of synchronization with the DC's clock.