---
updatedAt: 2025-08-14T18:21:22.000Z
agentTools:
  siteIndex: https://developer.n-able.com/llms.txt
  projectIndex: https://developer.n-able.com/n-central/llms.txt
---

# Failed Login Detection - PowerShell

```powershell PowerShell
# Prompt for threshold
$Threshold = Read-Host "Enter the threshold for failed login attempts"

# Prompt for time window (in minutes)
$TimeWindow = Read-Host "Enter the time period (in minutes) to check for failed logins"

# Convert input values to integers
$Threshold = [int]$Threshold
$TimeWindow = [int]$TimeWindow

# Get current time and subtract the specified number of minutes
$startTime = (Get-Date).AddMinutes(-$TimeWindow)

# Define filter for Security log and Event ID 4625 (failed login)
$filter = @{
    LogName = 'Security'
    Id = 4625
    StartTime = $startTime
}

try {
    # Get the events
    $failedLogins = Get-WinEvent -FilterHashtable $filter -ErrorAction Stop
} catch {
    # If no events are found or an error occurs, treat it as zero
    $failedLogins = @()
}

# Count the events safely
$failedCount = $failedLogins.Count

# Output result
Write-Output "Failed login attempts in the last $TimeWindow minutes: $failedCount"

if ($failedCount -ge $Threshold) {
    Write-Output "Alert: Failed login attempts detected."
} else {
    Write-Output "No significant failed login activity."
}

```

```json Response Example
{"success":true}
```

# Download PS1 File





# Run PS1 file against device





# Input the threshlod for failed logins and the time period in minutes



This PowerShell script will check for failed logins over a period of time.