WINDOWS LOGON TYPES
Logon
Number
0
Logon Type
Example
Logon Right
Used only by the System account
System startup.
2
Interactive: Used to log on at the
local console
User logon at console at the
beginning of the day.
3
Network: Used to access a
Windows resource (e.g., shared
folder) from a system on the
network
One example is when a computer has Access this computer
a mapped drive to another computer from the network
share.
4
Batch Job: Used to run a scheduled Task Scheduler or AT command.
task as a specified account
5
Service: Used to run a service as a
specified account
6
Proxy
7
Unlock (i.e. unattended workstation When a screen saver locks a system,
with password protected screen
the password must be entered to
saver)
access the system at the console.
8
NetworkCleartext (Logon with
credentials sent in the clear text.)
9
NewCredentials such as with RunAs This logon type does not seem to
or mapping a network drive with
show up in any events. Microsoft
alternate credentials.
explanation: Allows the caller to
clone its current token and specify
new credentials for outbound
connections. The new logon session
has the same local identify, but uses
different credentials for other
network connections.
Log on locally
Log on as a batch job
Credentials for an account other than Log on as a service
local service can be used for services
such as Telnet.
Most often indicates a logon to IIS
with "basic authentication".
10
RemoteInteractive
Terminal Services, Remote Desktop
or Remote Assistance.
11
CachedInteractive
Logon that uses cached domain
credentials (such as when logging on
to a laptop when away from the
network).
12
CashedRemoteInteractive
Logon that occurs when the remote
system is away from the network DC.
13
CashedUnlock
Unlock that occurs when the remote
system is away from the network DC.
Log on through Terminal
Services