RDP Exclusions for Security Event ID 4625

• Security Log Event ID 4625 overview
• How to configure RDP exclusions
• Exclusion rules syntax and examples

RdpGuard uses Windows Security event 4625 to detect failed login attempts. These events can come from Remote Desktop connections, network shares, services or scheduled tasks. Attempts detected by this engine appear as RDP in the Dashboard, even when they originate from another type of Windows logon.

Use exclusion rules when you can identify legitimate activity by specific event fields. Matching events are skipped by the RDP detection engine. To exempt a trusted IP address from blocking altogether, use the whitelist.

In Event Viewer, Windows Logs, Security, open an event with Event ID 4625:

1. Open RdpGuard Dashboard and click RDP under Monitored protocols.

   

2. In RDP Settings, click Exclusions....

   Enable RDP protection must be selected to edit exclusions.

   

3. Enter one rule per line in RDP Exclusions, then click OK.

   The syntax and examples below explain how to write rules.

   

4. Click Save in RDP Settings to apply the exclusions.

Write each rule on a separate line. Separate conditions within a rule with commas. An event is excluded if all conditions in any one rule match.

IpAddress=192.0.2.25,TargetUserName=backup-user
IpAddress=198.51.100.20,TargetUserName=svc-*

The first rule excludes events for backup-user from 192.0.2.25. The second excludes events for usernames beginning with svc- from 198.51.100.20. Replace these example addresses and usernames with values from the events you want to exclude.

Matching rules

• = matches a value or wildcard pattern; != matches values that do not match it.
• * matches any sequence of characters; ? matches one character.
• Conditions separated by commas use AND. Rules on separate lines use OR.
• Field names and values are case-sensitive. Copy their spelling and case from the event XML.
• If a field is absent from the event, a condition using it does not match, including a != condition.
• Lines beginning with # are comments.

For example, IpAddress=192.0.2.25,TargetUserName!=backup-user matches other usernames from that address. Keep conditions on the same line when they must match together. Putting an IP address and a username on separate lines creates two independent exclusions.

Fields available for RDP exclusions

Open the event's Details tab and select XML View. Use the names and values inside EventData. For example, <Data Name="LogonType">3</Data> provides the field LogonType with value 3.

Example XML for the event shown above:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing"
      Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2026-09-29T08:06:12.6465802Z" />
    <EventRecordID>27682099</EventRecordID>
    <Correlation
      ActivityID="{96b13ecf-444f-0004-fa3e-b1964f44dd01}" />
    <Execution ProcessID="764" ThreadID="140" />
    <Channel>Security</Channel>
    <Computer>SERVER01</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-0-0</Data>
    <Data Name="SubjectUserName">-</Data>
    <Data Name="SubjectDomainName">-</Data>
    <Data Name="SubjectLogonId">0x0</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">Admin</Data>
    <Data Name="TargetDomainName">.</Data>
    <Data Name="Status">0xc000006d</Data>
    <Data Name="FailureReason">%%2313</Data>
    <Data Name="SubStatus">0xc0000064</Data>
    <Data Name="LogonType">3</Data>
    <Data Name="LogonProcessName">NtLmSsp</Data>
    <Data Name="AuthenticationPackageName">NTLM</Data>
    <Data Name="WorkstationName">-</Data>
    <Data Name="TransmittedServices">-</Data>
    <Data Name="LmPackageName">-</Data>
    <Data Name="KeyLength">0</Data>
    <Data Name="ProcessId">0x0</Data>
    <Data Name="ProcessName">-</Data>
    <Data Name="IpAddress">95.47.156.55</Data>
    <Data Name="IpPort">0</Data>
  </EventData>
</Event>

Not every field has a useful value in every event. Use the value actually recorded in XML; for example, FailureReason may contain a code such as %%2313, rather than the description shown on the General tab. For full field definitions, see Microsoft's Event 4625 reference.

Using this syntax for other exclusions

The same rule syntax is used for successful logon exclusions in Custom Actions and successful logon logging. The available fields depend on the event and where the rule is applied.

For successful logon notifications, RdpGuard supplies Protocol, TargetUserName and IpAddress. Windows logon events can also supply their original EventData fields. For example, Protocol=FTP,TargetUserName=backup-user excludes successful FTP logon notifications for that account.

Protocol is added by RdpGuard; it is not an EventData field in event 4625 and is not available in the RDP Exclusions dialog.