Tools · Windows security and Event Logs · 02 / 27
Windows Event ID 4624 logon types explained: 2, 3, 5, 7, 10, and 11
Understand each logon type in a successful 4624 event, which ones expose credentials on the target, and how to filter out the noise from service logons.
The logon types
Event 4624 records a successful logon. The Logon Type field says how. Type 2 is interactive at the console. Type 3 is network, such as accessing a share. Type 4 is batch, used by scheduled tasks. Type 5 is a service starting under an account. Type 7 is unlocking a workstation. Type 8 is network with cleartext credentials, for example IIS basic authentication. Type 9 is NewCredentials, created by runas /netonly. Type 10 is RemoteInteractive, meaning Remote Desktop. Type 11 is a cached interactive logon when no domain controller was reachable.
Types 2, 10, and 11 leave reusable credentials in memory on the target, which is why administrators should avoid them on untrusted machines. Type 3 usually does not.
Other fields worth reading
Logon ID links this logon to later events from the same session, including 4672 for special privileges and 4634 or 4647 for logoff. Authentication Package and Logon Process tell you whether Kerberos or NTLM was used. Elevated Token says whether the session has administrator rights. Source Network Address and Workstation Name show where it came from.
Linked Logon ID pairs the elevated and non-elevated sessions created for an administrator under User Account Control.
Lab: create one logon of each common type
On a Windows lab VM, log on at the console, unlock the screen, connect with RDP from another VM, map a share from another VM, and create a scheduled task that runs as a local user. Then list 4624 events from the last hour grouped by logon type and target user, excluding SYSTEM and the machine account.
You should see one row per action, which makes the logon type table concrete.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-1)} |
ForEach-Object { $x=[xml]$_.ToXml(); $d=@{}; $x.Event.EventData.Data | % { $d[$_.Name]=$_.'#text' }
[pscustomobject]@{Time=$_.TimeCreated; User=$d.TargetUserName; Type=$d.LogonType; Auth=$d.AuthenticationPackageName; From=$d.IpAddress} } |
Where-Object { $_.User -notmatch '\$|^SYSTEM$|^(LOCAL|NETWORK) SERVICE$|^(DWM|UMFD)-' } | Sort-Object Type | Format-TableHunting with logon types
Type 10 logons to servers from workstations outside an admin jump host list are worth an alert. Type 3 logons with NTLM from unexpected sources can indicate credential reuse. Type 9 is unusual for ordinary users and appears in some lateral movement tools.
Service and batch logons for human accounts often mean someone stored their own password in a scheduled task, which breaks when they leave and exposes their credential.
Diagram
Logon types and credential exposure
Where an administrator’s credential ends up.
Type 2. Console logon.
Type 10. Remote Desktop.
Type 11. Cached domain logon.
Type 3. Network logon to a share or service.
Type 4 and 5. Batch and service, but the password is stored for the task or service.
Advice. Admins use type 3 tools from a trusted host.
Check yourself
1. Which logon type is Remote Desktop?
2. Which field links a 4624 to later events in the same session?
3. Why should admins avoid type 10 logons to untrusted machines?