From ee9ea1c8450dfc67f4dcf7c9f059e8224e74681b Mon Sep 17 00:00:00 2001
From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com>
Date: Thu, 20 Jan 2022 09:47:36 +0100
Subject: [PATCH] add detail this also logs event 4625

We may have customers seeing event 4625 as additional hint the task failed.
---
 .../credential-guard/credential-guard-known-issues.md           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
index 1dae9e49d5..a27265135f 100644
--- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
+++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md
@@ -33,7 +33,7 @@ The following known issue has been fixed in the [Cumulative Security Update for
    Failure occurred in ‘LogonUserExEx’. <br>
    User Action: Ensure the credentials for the task are correctly specified. <br>
    Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect)."
--  When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. For example:
+-  When enabling NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You get a similar user name in a user logon failure event 4525 wiith error 0xC0000064 on the machine itself. For example:
    > Log Name: Microsoft-Windows-NTLM/Operational  
     Source: Microsoft-Windows-Security-Netlogon  
     Event ID: 8004