What are the logon types?
Logon Types
| Logon Number | Logon Type |
|---|---|
| 0 | Used only by the System account |
| 2 | Interactive: Used to log on at the local console |
| 3 | Network: Used to access a Windows resource (e.g., shared folder) from a system on the network |
| 4 | Batch Job: Used to run a scheduled task as a specified account |
What kind of logon is Type 2?
Logon Type:
| Logon Type | Description |
|---|---|
| 2 | Interactive (logon at keyboard and screen of system) |
| 3 | Network (i.e. connection to shared folder on this computer from elsewhere on network) |
| 4 | Batch (i.e. scheduled task) |
| 5 | Service (Service startup) |
What event ID is logon?
Event ID 4624
Introduction. Event ID 4624 (viewed in Windows Event Viewer) documents every successful attempt at logging on to a local computer. This event is generated on the computer that was accessed, in other words, where the logon session was created.
What is login Type 3?
Logon type 3: Network. A user or computer logged on to this computer from the network. The description of this logon type clearly states that the event logged when somebody accesses a computer from the network. Commonly it appears when connecting to shared resources (shared folders, printers etc.).
What is a logon type 5?
Logon type 5: Service. A service was started by the Service Control Manager. When Windows starts a service which is configured to log on as a user, Windows will create a new logon session for this service. This happens only if the service uses a “common” user account.
What is network logon Type 3?
What is an interactive login?
Interactive login is authentication to a computer through the usage of their local user account or by their domain account, usually by pressing the CTRL+ALT+DEL keys (on a Windows machine). When the user is logged in, Windows will run applications on behalf of the user and the user can interact with those applications.
What is the difference between event 540 and logon type 8?
Event 540 gets logged when a user elsewhere on the network connects to a resource (e.g. shared folder) provided by the Server service on this computer. The Logon Type will always be 3 or 8, both of which indicate a network logon. Logon type 3 is what you normally see. Logon Type 8 means network logon with clear text authentication.
What do event IDs 528 and 540 mean?
Event IDs 528 and 540 signify a successful logon, event ID 538 a logoff and all the other events in this category identify different reasons for a logon failure. However, just knowing about a successful or failed logon attempt doesn’t fill in the whole picture.
What is an logon Type 5 service?
Logon Type 5 – Service Similar to Scheduled Tasks, each service is configured to run as a specified user account. When a service starts, Windows first creates a logon session for the specified user account which results in a Logon/Logoff event with logon type 5.
What are the different types of Logon codes?
Logon Type Codes Revealed. Logon Type 2 – Interactive. This is what occurs to you first when you think of logons, that is, a logon at the console of a computer. You’ll see type Logon Type 3 – Network. Logon Type 4 – Batch. Logon Type 5 – Service. Logon Type 7 – Unlock.