Recurring Event 4625 "An account failed to log on" from NortonUI.exe

Norton 360 for Windows
1

Starting some days ago there are several Event 4625 per day logged.

Event 4625 are “An account failed to log on” events and the details show

Account Name : -username-

Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A

Caller Process Name: C:\Program Files\Norton\Suite\NortonUI.exe

2

Hello @jwsg
Are you running Norton v360 26.2.10802 (build 26.2.10802.970)?
Can you run Norton LiveUpdate?
Can you Sign-out Norton → Restart (not Shut down) machine → Sign-in Norton?
Please share your progress:

===============================

~fwiw~ AI sourced:
The multiple Event 4625 entries appearing in your logs indicate that Norton Security Suite is attempting to authenticate with a valid username but an incorrect password. Because the “Caller Process Name” is explicitly identified as NortonUI.exe, this is almost certainly caused by the software using outdated cached credentials for an automated task rather than a security threat like an external attack.

Error Code Breakdown

  • Event 4625: A logon request failed.
  • Status 0xC000006D: The logon attempt was invalid due to a bad username or authentication information.
  • Sub Status 0xC000006A: The username is correct, but the password is wrong.

Common Causes & Solutions
The behavior often starts after you change your Windows or domain password, as the Norton software may still be trying to use the old one for features like identity protection, cloud backups, or management tasks.

  1. Update Norton Password Manager/Identity Safe: If you use Norton’s built-in password management features, log out and log back in with your current credentials to refresh the cached data.
  2. Check Scheduled Tasks/Cloud Backup: If you have scheduled backups to a network drive or the cloud, ensure the account credentials used for those schedules are updated to match your current password.
  3. Clear Cached Credentials: Use the Windows Credential Manager to look for any stored entries related to Norton or network shares that might contain the old password.
  4. Reinstall or Update Norton: If the issue persists, a “refresh” of the application using the Norton Remove and Reinstall tool can often clear out stuck authentication states that lead to these errors.

Have you recently changed your Windows or network password, or did you recently enable a specific Norton feature like Cloud Backup or Identity Shield?

=====================

In Norton 360 v26, the frequent Event 4625 logs originating from NortonUI.exe are almost certainly caused by the Password Manager or Cloud Backup background processes trying to use an outdated Windows credential to sync data or unlock a vault.

Even if you aren’t actively using a feature called “Identity Shield,” version 26 includes several “Identity” components that run in the background:

High-Probability Triggers in v26

  • Password Manager (Vault Sync): If you have the browser extension or the main app set to “Remember Me” but recently changed your Windows account password, the background sync process will fail repeatedly with Sub Status 0xC000006A (correct username, wrong password).
  • PC Cloud Backup: This feature often runs as a background service. If it was configured to use your specific user account for permissions and that account’s password changed, it will trigger these logs every time it attempts a scheduled check.
  • Identity Lock / Credit Monitoring: Modern Norton 360 plans (including v26) include Identity Lock and Dark Web Monitoring. These features require a persistent, authenticated connection to your Norton account.

How to Resolve in v26

  1. Re-authenticate the Suite: Open the Norton 360 interface, click on your Account Name (usually top right), select Sign Out, restart your PC, and then Sign In again with your current Norton credentials. This refreshes the underlying security tokens for all sub-processes.
  2. Update the Password Manager: If you use the vault, manually log out of the Norton Password Manager in all browsers and the main app, then log back in.
  3. Check Backup Settings: Go to Settings > Backup Settings and verify the “Where” (destination). If it’s a network drive or cloud storage, ensure the “Login” details are current.
  4. Clear Windows Credentials: Open the Windows Credential Manager and remove any “Generic Credentials” related to Norton or Symantec. The app will prompt you for the correct ones the next time it needs them.

Did these logs start appearing immediately after a Windows password change, or did you recently enable Cloud Backup?

=================================

~Note:~ AI sourced content may make mistakes

3

Thanks but I’ve already seen AIs view that it’s using outdated credentials, it’s the most frequent solution posted to event 4625 questions. Norton is fully up to date and the issue remains after a repair and re-install. I’d already looked in Credential Manager, but what AI can’t say is what credential is outdated, whether there was a 360 update in the last week, and why Norton is trying to log in as user. Not really looking for a fix just posting an observation.

1 Like
4

Oh! Okay.

Note: for critical matters like billing, legal issues, or account security, it is always best to verify directly with Official Norton Support → Contact us

5

I’ll verify. It’s behavior I’ve been seeing for a while now. I used to get three in a row of the same thing, but putting Smart Scan on manual seems to have eliminated two of them, now it’s just that one. Don’t think it’s something that can be willingly reproduced so I doubt it’s able to be logged.

2 Likes
6

It seems to happen on startup and every three hours - so it appears to be some programmed activity rather than something random. Only noticed it recently and wasn’t resolved by the latest patch.

Online chat support wasn’t much help - mentioning that’s these events are due to stored/invalid credentials or a permission mismatch, but without explaining why Norton is repeatedly trying (and failing) to log-in (meaning Windows user account not the Norton account) in the first place. There are no obvious outdated credentials. I was unable to get a case raised through to development.

They would be visible under the Audit Failure category on Event Viewer

7

~ fwiw ~

image
image1240×415 141 KB

8

As they’re daily in pairs it’s worth checking they’re ones from NortonUI.exe and mention password failure for the Windows user’s account - as there can be other occasional 4625 over time from other sources that are ‘Account currently disabled’ or similar.

9

Hello @jwsg
What Filter do you use?
~ fwiw ~ my 8 Audit Failure events are all: NULL SID

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 3/31/2026
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: HPW11
Description:
An account failed to log on.

Subject:
Security ID: NULL SID

10

Just recently I got 26.3.10886 but this started in the last week or so with a 26.2 version.

I think those are more likely some ‘background’ 4625s that always seem to happen over time, scrolling down to Process Information: Caller Process Name: it likely won’t say “C:\Program Files\Norton\Suite\NortonUI.exe”.

The Windows Event log is always full of various events, most of which can be ignored, but seeing regular 4625s with a security ID of the Windows login and a source of NortonUI.exe, was unusual enough to mention - although it’s not something that affects everyone by the look of it.