← All cheat sheets

WINDOWS LOGON TYPES

Plain-text reference · 5 KB. Read it, search it (Ctrl-F) or print it.

The LogonType field appears in Security Event ID 4624 (success) and 4625
(failure). It tells you HOW an account authenticated, which is central to
triaging suspicious access. Values below are from Microsoft documentation.

LOGON TYPE TABLE#

Type  Name                  Meaning / when you see it
----  --------------------  ----------------------------------------------
2     Interactive           Logon at the console (keyboard/screen), or via
                            RunAs on the local machine. Also RDP from the
                            local console session in some cases.
3     Network               Access to this computer from the network:
                            SMB file shares, IPC$, some service auth. Most
                            common type by far. Pass-the-hash often shows as
                            Type 3 with NTLM.
4     Batch                 Scheduled task / batch job running as an account.
5     Service               A service started by the Service Control Manager
                            using its configured account.
7     Unlock                Workstation unlocked (screensaver/lock screen).
8     NetworkCleartext      Network logon where the password was sent in
                            cleartext (e.g. IIS Basic auth). Rare; investigate
                            if unexpected.
9     NewCredentials        RunAs with /netonly -- process uses new creds for
                            network connections only, keeping local identity.
                            Seen with credential-theft tooling and admin use.
10    RemoteInteractive     Terminal Services / RDP / Remote Assistance.
                            Interactive logon over the network.
11    CachedInteractive     Interactive logon using cached domain creds
                            (DC was not reachable, e.g. laptop offline).
12    CachedRemoteInteractive  Like 10 but using cached credentials.
13    CachedUnlock          Unlock using cached credentials.
0     System / UNKNOWN      Used by the System account at startup; also seen
                            as 0 where a type is not applicable.

TRIAGE RELEVANCE#

Type 2 (Interactive)
  - Direct console access. For a server, interactive logons by non-admins
    or at odd hours are worth review.
  - RunAs elevation also appears here.

Type 3 (Network)
  - Normal for file-share and service access; extremely high volume.
  - Watch for: NTLM where Kerberos is expected, logons from workstation IPs
    to many hosts (lateral movement), service/admin accounts authenticating
    from unusual sources.
  - Pass-the-hash commonly manifests as Type 3 + NTLM + no preceding 4768.

Type 4 (Batch) / Type 5 (Service)
  - Expected for scheduled tasks and services. A NEW Type 5 for a sensitive
    account can indicate a malicious service (correlate with 7045/4697).
  - Type 4 appearing for a user account can mean a new scheduled task
    (correlate with 4698).

Type 7 (Unlock) / 13 (CachedUnlock)
  - Normal user activity. Useful to confirm physical presence timeline.

Type 8 (NetworkCleartext)
  - Credentials crossed the wire in cleartext. Legitimate only for specific
    legacy services; otherwise a finding.

Type 9 (NewCredentials)
  - "runas /netonly" pattern. Legitimate for admins, but also associated
    with credential misuse -- correlate the account and target.

Type 10 (RemoteInteractive = RDP)
  - Key lateral-movement and remote-access signal. Review:
    source IP, account, time, whether the account normally uses RDP.
  - Correlate with 4778/4779 (session reconnect/disconnect) and
    Microsoft-Windows-TerminalServices logs.

Type 11/12 (Cached)
  - Authenticated against cached creds, DC not consulted. Normal for mobile
    devices; unexpected on a server may indicate DC connectivity issues.

USEFUL CORRELATIONS#

- 4624 (success) + LogonType -> pair with 4634/4647 (logoff) for duration.
- 4625 (failure) + LogonType 10 bursts -> RDP brute force.
- 4625 LogonType 3 bursts across many usernames -> password spray.
- 4648 (explicit credentials) often precedes a Type 3/10 on a remote host.
- RemoteInteractive (10): also see Event 4778/4779 and
  "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational".

QUICK POWERSHELL (read-only triage)#

# Recent interactive/RDP logons (types 2 and 10)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 200 |
  Where-Object { $_.Properties[8].Value -in 2,10 } |
  Select-Object TimeCreated,
    @{n='User';e={$_.Properties[5].Value}},
    @{n='Type';e={$_.Properties[8].Value}},
    @{n='SrcIP';e={$_.Properties[18].Value}}

(Property indexes above are for 4624 on modern Windows; verify on your build.)

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.