Windows logon types explained
Every logon type in Event ID 4624 and 4625, from 2 to 13, with what it looks like in normal use and which ones point to RDP abuse, lateral movement or pass-the-hash.
Every successful logon writes Event ID 4624 to the Security log, and every failure writes 4625. Both carry a Logon Type number that says how the account logged on. Reading it correctly is the fastest way to separate normal activity from an intruder moving around.
All logon types at a glance
| Type | Name | Normal example | Watch for |
|---|---|---|---|
0 | System | The computer starting up | Nothing; only the SYSTEM account |
2 | Interactive | User at the keyboard, or Hyper-V/VMware console | Admin accounts logging on to workstations |
3 | Network | Opening a file share, Group Policy, many admin tools | Workstation-to-workstation logons with NTLM: lateral movement |
4 | Batch | Scheduled tasks | New tasks running as privileged accounts |
5 | Service | Services starting under a service account | Services created by attackers (pair with 7045) |
7 | Unlock | Unlocking the screen | Rarely interesting |
8 | NetworkCleartext | IIS basic authentication, some PowerShell remoting | Password sent in clear text over the network |
9 | NewCredentials | runas /netonly | Logon process seclogo with type 9 is a classic pass-the-hash sign (Mimikatz sekurlsa::pth) |
10 | RemoteInteractive | Remote Desktop | RDP from public IPs, or from hosts that never use RDP |
11 | CachedInteractive | Laptop logon without reaching a domain controller | Mostly normal; useful for travel timelines |
12 | CachedRemoteInteractive | RDP using cached credentials (also Microsoft accounts) | Same checks as type 10 |
13 | CachedUnlock | Unlock with cached credentials | Rarely interesting |
The four that matter most in investigations
Type 10: Remote Desktop
Every RDP session should be explainable. A type 10 logon whose Source Network Address is a public IP means RDP is reachable from the internet, which is one of the most common ransomware entry points. Check the preceding 4625 failures: a burst of failures and then a type 10 success is a guessed password.
Type 3: Network
Type 3 is the noisiest type and the one attackers hide in. Normal type 3 traffic goes from workstations to servers. Watch for workstation to workstation logons, admin accounts logging on to many machines in a short time, and NTLM where Kerberos is expected. Tools such as PsExec, WMI and SMB-based lateral movement show up here, usually next to a 7045 (new service) or 5145 access to ADMIN$.
Type 9: NewCredentials
Legitimate type 9 logons come from runas /netonly, which few people use. Type 9 with logon process seclogo and authentication package Negotiate on a workstation is a strong indicator of pass-the-hash. It deserves an alert on its own.
Type 2: Interactive with privileged accounts
Domain Admins should not log on interactively to ordinary workstations. Doing so leaves their credentials in memory where tools can dump them. Interactive logons by privileged accounts outside admin workstations are a hygiene finding even when nothing malicious happened.
Other fields to read with the logon type
- Elevated Token (Yes/No): whether the session has admin rights.
- Logon ID: links this logon to everything the session did afterwards (process creation 4688, logoff 4634).
- Logon Process / Authentication Package:
User32/Negotiatefor normal interactive,NtLmSsp/NTLMfor NTLM network logons. - Special privileges (4672): logged right after 4624 when the account has admin-level privileges.
Quick hunting queries
// Sentinel: RDP logons from public IPs in the last 7 days
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4624 and LogonType == 10
| where not(ipv4_is_private(IpAddress)) and IpAddress !in ("-", "127.0.0.1")
| summarize Logons = count(), Hosts = make_set(Computer) by TargetAccount, IpAddress// Sentinel: possible pass-the-hash (type 9 via seclogo)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4624 and LogonType == 9
| where LogonProcessName has "seclogo"
| project TimeGenerated, Computer, TargetAccount, SubjectAccount, IpAddressWindows Event Triage highlights RDP from public IPs, success after brute force, new admins and more.