Logon type

The logon type is a numeric field in Security event IDs 4624 (successful logon) and 4625 (failed logon) that records how the session was created. It is logged on the machine that was accessed, which makes it central to reconstructing lateral movement from Windows event logs.

Type	Name	Typical cause
2	Interactive	Logon at the console keyboard
3	Network	Access to a share, remote service or WMI from the network
4	Batch	Scheduled task running as a user
5	Service	Service started by the Service Control Manager
7	Unlock	Workstation unlocked
8	NetworkCleartext	Network logon with the password passed in unhashed form
9	NewCredentials	Cloned token with new outbound credentials, e.g. `runas /netonly`
10	RemoteInteractive	Remote Desktop or Terminal Services
11	CachedInteractive	Logon with cached domain credentials, no domain controller contacted

Types 0 (System), 12 and 13 also exist but are less common. Read the logon type together with the source network address, workstation name and logon ID: the logon ID links the logon to the processes and logoff that follow in the same session. Type 10 events are a starting point for the RDP connection artifacts, while bursts of type 3 logons from one host to many others are a classic lateral movement pattern.

Related artifacts