SOLVED: Different Logon Types Explained

In the Windows Event Viewer you will frequently see events 4624 and 4625 in the Security Log but the entry will only give you a number and one word description, which is not great.

In this article we explain what the different Logon Types mean:

What is Logon Type 0 – System?

Logon Type 0 – System means that the computer was started up.

What is Logon Type 2 – Interactive?

Logon Type 2 – Interactive means that a user tried to sign in.

What is Logon Type 3 – Network?

Logon Type 3 – Network means that a something connected to this machine through the network. In other words, a user or another computer connected to this computer remotely, likely through a SMB share or shared printer.

What is Logon Type 4 – Batch?

Logon Type 4 – Batch means that a Scheduled Task connected to this computer. Note that if the Scheduled Task is set to run only when a designated user is logged on, this event will NOT be logged.

What is Logon Type 5 – Service?

Logon Type 5 – Service means that a service started was started by the Service Control Manager and logged in to do whatever it has to do. Note that this event will only be logged if the service is started with a regular user account and it will NOT be logged if the service is running as a “special account” like the Local System or NT AUTHORITY\LocalService .

What is Logon Type 7 – Unlock?

Logon Type 7 – Unlock means that a user tried to sign in. This is different from an initial logon which would be logged as Logon Type 2.

What is Logon Type 8 – NetworkCleartext?

Logon Type 8 – NetworkCleartext means that a user connected to this computer without the credentials being encrypted. In todays world, this would be very unusual to see but it was common 20 years ago. You might see it when someone is setting up an IIS Web Server or during some testing, but moving passwords through any network in clear text is a very risky proposition, because it is so easy to use a “packet sniffer” like WireShark to read it.

Many programs that used to accept clear text passwords have disabled that possibility now:

In September 2021, we announced that effective October 1, 2022, we will begin disabling Basic authentication for Outlook, EWS, RPS, POP, IMAP, and EAS protocols in Exchange Online. SMTP Auth will also be disabled if it is not being used.

learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

What is Logon Type 9 – NewCredentials?

Logon Type 9 – NewCredentials means that someone started a program or connection using RUN AS.

What is Logon Type 10 – RemoteInteractive?

Logon Type 10 – RemoteInteractive means that someone has logged in using Remote Desktop (RDS), Terminal Services or Remote Assistance

There are a few more but they are even more rarely used.

Here are a few of the most common connection methods:

Connection Method	Logon Type	Reusable Credentials on Destination	Comments
Log on at console	Interactive	Credentials ARE Exposed	Includes hardware remote access / lights-out cards and network KVMs.
RUNAS	Interactive	Credentials ARE Exposed
RUNAS /NETWORK	NewCredentials	Credentials ARE Exposed	Clones current LSA session for local access, but uses new credentials when connecting to network resources.
Remote Desktop (success)	RemoteInteractive	Credentials ARE Exposed	If the remote desktop client is configured to share local devices and resources, those may be compromised as well.
Remote Desktop (failure – logon type was denied)	RemoteInteractive	Credentials are NOT Exposed	By default, if RDP logon fails credentials are only stored briefly. This may not be the case if the computer is compromised.
Net use * \\SERVER	Network	Credentials are NOT Exposed
Net use * \\SERVER /u:user	Network	Credentials are NOT Exposed
MMC snap-ins to remote computer	Network	Credentials are NOT Exposed	Example: Computer Management, Event Viewer, Device Manager, Services
PowerShell WinRM	Network	Credentials are NOT Exposed	Example: Enter-PSSession server
PowerShell WinRM with CredSSP	NetworkClearText	Credentials ARE Exposed	New-PSSession server -Authentication Credssp -Credential cred
PsExec without explicit creds	Network	Credentials are NOT Exposed	Example: PsExec \\server cmd
PsExec with explicit creds	Network + Interactive	Credentials ARE Exposed	PsExec \\server -u user -p pwd cmd Creates multiple logon sessions.
Remote Registry	Network	Credentials are NOT Exposed
Remote Desktop Gateway	Network	Credentials are NOT Exposed	Authenticating to Remote Desktop Gateway.
Scheduled task	Batch	Credentials ARE Exposed	Password will also be saved as LSA secret on disk.
Run tools as a service	Service	Credentials ARE Exposed	Password will also be saved as LSA secret on disk.
Vulnerability scanners	Network	Credentials are NOT Exposed	Most scanners default to using network logons, though some vendors may implement non-network logons and introduce more credential theft risk.

---