How can I play a wav sound for a bad password entered at windows logon

Event id 4625 is generated on a failed logon
Windows Security Log Event ID 4625 - An account failed to log on


..so you might be able to set up a scheduled task triggered on that event id.
Create task, Begin Task, On event id ....

You'd need to set up the conditions carefully e.g. run whether user is logged on or not.

Never tried such a thing personally, so see how it goes.

You need to research the command line invocation for a player

Example: I searched for
vlc player command line

How to Add VLC to the Command Prompt in Windows

WMP:
Control Windows Media Player Behaviour with Command Line Parameters - Tech Journey

Take it step by step checking each element:

Test your command line at a normal command prompt.

Then add to a simple scheduled task for test purposes that you then run manually- just to check that works.

Then you can try creating the task you want.

I see it a bit differently, many things in Windows don't work until after the user has logged on, sound features other than what may be built-in to base files that load the OS like used to play in older versions when they started up.

Hi, granted, that's why I said 'might' at the start and that I'd not tried it. That's just the only kind of option I can think of. Whether it's feasible.. we'll see.

I've done a little more research for you: this is how to get vlc playing a sound without having vlc display anything at all from a command prompt:

"D:\Multimedia\Players\VLC player\vlc.exe" -I dummy --dummy-quiet "E:\My sounds\alert.wav" vlc://quit

Here I've explicitly given the path to vlc player on my PC; note the "" around strings containing a space.
Naturally you will need to change the paths on yours.

Reference:
VLC Comman Line Options like no GUI --play-and-exit ? - The VideoLAN Forums

Create a bat file containing that command line- test it from a command prompt.
The bat file is what you execute from your scheduled task.

Now the big unknown is
a. getting the scheduled task triggered
b. getting a sound played - when you're not logged on

For this, vlc player may not be a good choice- I don't know.

And the first problem I note is that despite research above, I don't see event id 4625 generated... so more research..

Success. That is, I got a sound a few seconds after entering an incorrect password.

(I also got the sound once after logging on, so needs a little tweak of some kind like testing if logged in or not- doesn't seem possible just using the task scheduler. Can be done using Autohotkey to create a simple script, rather than a bat file. Maybe there's a way using a bat file).

Investigation, using Fulleventlogview by NirSofer, showed the eventid needed on wrong password entry is 2

I created a bat file, choosing to use a simple command line player called 'sounder' which I downloaded.
sounder.exe - play a wav file from the command line

I created a bat file:
"E:\User folders\Desktop\sounder.exe" "E:\My sounds\alert.wav"
(here I put sounder.exe on my desktop, just for demo purposes, and used an existing wav file).

I created a task, using info from Fulleventlogview that told me from which source I needed to monitor logs


Event: (takes a while to open, long tree to navigate, pick just one)


Action: (the bat file is on my desktop for demo purposes)


General:

Ok, basic check: does the sound play if you open the task scheduler and rt click the task and run it?

To help with debugging, try adding a line like this to check if the task runs when logged off:
echo I ran >> "<your path>\pwdalertresult.txt"

- this creates a file (just different to playing a sound in case that's a problem for some reason). If the file is created, the task has been executed.

Make sure you have the task trigger conditions right, including run whether logged in or not.

This is purely experimental - no guarantees. I found sometimes it does, sometimes it doesn't.