Share this article
Improve this guide
4648: A Logon was Attempted Using Explicit Credentials [Fix]
Someone how tried to gain access to your network, so act now
5 min. read
Updated onMarch 18, 2024
updated onMarch 18, 2024
Share this article
Improve this guide
Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more
Key notes
Event ID 4648 isn’t an error, per se, as it’s the intended result of someone trying toenter a network serverusing different or new credentials. It’s supposed to block you from entering; that’s its purpose.
This Event ID is a problem because it’s a sign that someone has or is trying tohack into your computer. To help out, we’ll show you what you can do to address this problem and beef up security.
How can I protect my computer when Event ID 4648 appears?
1. Check event logs
This solution and the next one go hand in hand. The purpose of the first is to do a bit of threat hunting, or in other words, figure out who is trying to gain access.
2. Remove account credentials
This solution is meant to remove users from a network that you no longer want them to have access to. External people or bad actors require another approach.
3. Change your Wi-Fi password
4. Disable Remote Access
You can also:
How can someone gain access to my Windows 11 computer?
A lot of the time, whenever people wonder how a hacker got into their machine, they usually think that person cracked open the computer’s tough defenses.
That’s certainly possible, but the more likely reason is that your computer’s or network’s own security is rather lacking.
Event ID 4648 is just one of many different warning notices on Windows 11. There are two in particular that we want to shout out specifically. The first one isEvent ID 157: Disk has been surprise removed.
This warning occurs when interrupts your computer’s communication with a disk and can render a virtual drive unusable. Fixing this may require you totweak the computer’s registry a little.
The other one isEvent ID 7000which indicates some software services cannot start. We recommend either adjusting with the Group Policy Editor or restarting the offending service.
For fixes and logon errors, you can check ourNavigating the Logon Balancing Error 88 in SAP GUI: Our step-by-step solutionsguide.
Feel free to comment below if you have questions about other Event IDs. You can also leave comments about guides that you’d like to see or information on other errors.
More about the topics:event log viewers,security
Cesar Cadenas
Networking & Security Specialist
Cesar has been writing for and about technology going on for 6 years when he first started writing tech articles for his university paper. Since then, his passion for technology blossomed into a prosperous writing career. He first started writing about tech in the entertainment world and would later move on to write about smart life tech and social media. He was recently a Technical Writer for tech company Extron where he wrote user guides for audio and video equipment.
He has since moved on to being a freelance writer looking to have a career in copywriting and hopes to share his love and knowledge of technology with the world. Recently, Cesar has written for the cryptocurrency news site, BTCPro and helping people understand tech.
User forum
0 messages
Sort by:LatestOldestMost Votes
Comment*
Name*
Email*
Commenting as.Not you?
Save information for future comments
Comment
Δ
Cesar Cadenas
Networking & Security Specialist
Cesar is a tech expert passionate about Windows, Microsoft, and anything surrounding the world of PCs.
