Windows Logon Types (4624, 4625)

Logon Type 2

Interactive logon at local console (keyboard/mouse, KVM, etc.) – distinguishes local hands-on activity from remote or service behavior

Logon Type 3

Network logon to access shared resources (SMB shares, printers, many IIS requests) – useful for spotting lateral movement or brute force against shares

Logon Type 4

Batch logon used by scheduled tasks/Task Scheduler jobs – helpful for detecting persistence via scheduled or automated jobs

Logon Type 5

Service logon by Windows services under service accounts – important for spotting suspicious or newly installed services used as backdoors

Logon Type 7

Unlock logon when a workstation is unlocked – helps tie activity to physical user presence and work patterns

Logon Type 8

NetworkCleartext logon where passwords are passed in cleartext to the auth package – indicates risky auth patterns and potential password exposure

Logon Type 9

NewCredentials logon (RunAs /netonly) where new network credentials are used but local identity remains the same – key for investigating odd “double identity” behavior

Logon Type 10

RemoteInteractive logon via RDP/Terminal Services remote GUI – critical for investigating remote admin activity and RDP-based lateral movement

Logon Type 11

CachedInteractive logon using cached domain credentials when the DC isn’t contacted – useful in cases involving offline machines or intermittent DC acces