A Logon Type in Windows identifies how a user or process authenticated to the system.
When authentication occurs, Windows records the event in the Security Event Log, assigning a numeric logon type.
Logon Type 0 – System
Description
- Used internally by the operating system
- Not associated with a real user login
- Represents system startup or internal authentication
Characteristics
- No user interaction
- Generated by kernel or core services
- Rarely seen in normal auditing
Security Context
- Not malicious
- Ignore unless paired with anomalies
Example
- System boot
- OS maintenance operations
Logon Type 2 – Interactive
Description
A user logs on directly at the computer console.
Examples
- Keyboard login
- Touchscreen login
- Smart card at physical machine
Key Details
- Requires physical or virtual console access
- Generates a desktop session
Security Use
- Track physical access
- Detect unauthorized local access
Risk
- Medium
- Dangerous if unexpected on servers
Logon Type 3 – Network
Description
Occurs when a user accesses a system over the network, without creating a desktop session.
Common Scenarios
- Accessing:
- File shares (SMB)
- Printers
- IIS
- SQL Server
- PowerShell remoting
- Mapping network drives
Key Detail
- No interactive shell
- Very common on servers
Security Risk
- High
- Frequently used in:
- Lateral movement
- Pass-the-Hash attacks
- Credential theft
SOC Tip
Excessive Logon Type 3 from workstations to servers is suspicious.
Logon Type 4 – Batch
Description
Used by scheduled tasks and batch jobs.
Examples
- Task Scheduler jobs
- Backup scripts
- Maintenance automation
Key Detail
- No user interaction
- Executed automatically
Security Risk
- Medium
- Malicious persistence often uses scheduled tasks
Detection Tip
- New or modified scheduled tasks + Logon Type 4 = red flag
Logon Type 5 – Service
Description
Used when a Windows service starts under a service account.
Examples
- SQL Server service
- IIS
- Antivirus engines
- Domain services
Characteristics
- Happens at boot or service restart
- Usually SYSTEM or service accounts
Security Risk
- Medium
- Attackers may:
- Create malicious services
- Abuse service accounts
Blue Team Note
Monitor for:
- New services
- Service accounts with high privileges
Logon Type 7 – Unlock
Description
Occurs when a locked workstation is unlocked.
Key Points
- Same user
- No credential revalidation in most cases
Example
- User presses Ctrl + Alt + Del
- Laptop unlock after inactivity
Security Risk
- Low
- Useful for tracking session activity
Logon Type 8 – NetworkCleartext
Description
Network authentication using cleartext credentials.
Common Causes
- Basic authentication
- Legacy protocols
- FTP
- Old IIS configurations
Why It’s Dangerous
- Password can be exposed
- Vulnerable to sniffing
Security Risk
- High
- Strong indicator of weak security posture
Action Required
- Disable cleartext auth
- Enforce Kerberos or NTLMv2
Logon Type 9 – NewCredentials
Description
Occurs when a user runs a process using alternate credentials, without logging out.
Example
runas /netonly /user:DOMAIN\Admin cmd.exe
Key Detail
- Original user remains logged in
- New credentials used only for network access
Security Risk
- Medium
- Often used legitimately by admins
- Also abused by attackers
Detection Tip
- Combine with suspicious command execution
Logon Type 10 – RemoteInteractive
Description
Remote login using Remote Desktop Protocol (RDP).
Examples
- RDP from workstation
- Jump server access
- Admin remote management
Key Details
- Creates full desktop session
- User is physically remote
Security Risk
- High
- Most common attack vector:
- Brute force
- Credential stuffing
- Ransomware entry
SOC Monitoring
- Monitor:
- Failed 4625 events
- Geo-location anomalies
- After-hours logins
Logon Type 11 – CachedInteractive
Description
Login using cached credentials when domain controller is unavailable.
Example
- Laptop login offline
- VPN down
Key Detail
- Credentials validated locally
- Limited access until DC available
Security Risk
- Medium
- Useful for forensic timelines
Logon Type 12 – CachedRemoteInteractive
Description
Cached credentials used for remote interactive login.
Notes
- Rare
- Seen in special RDP or laptop scenarios
Risk
- Medium
- Treat similarly to Logon Type 10
Logon Type 13 – CachedUnlock
Description
Unlocking a workstation using cached credentials.
Scenario
- Laptop unlock while offline
Security Risk
- Low
Complete Logon Type Table
| Logon Type | Name | Description | Common Use Case | Risk Level |
|---|---|---|---|---|
| 0 | System | Used internally by Windows | OS processes | Low |
| 2 | Interactive | Local console login | Physical login | Medium |
| 3 | Network | Access via network | File shares, SMB | High |
| 4 | Batch | Scheduled tasks | Automation | Medium |
| 5 | Service | Service account logon | Windows services | Medium |
| 7 | Unlock | Unlocking workstation | User unlocks PC | Low |
| 8 | NetworkCleartext | Cleartext auth over network | Legacy auth | High |
| 9 | NewCredentials | RunAs / secondary credentials | Admin tasks | Medium |
| 10 | RemoteInteractive | RDP login | Remote Desktop | High |
| 11 | CachedInteractive | Cached credentials | Offline login | Medium |
| 12 | CachedRemoteInteractive | Cached RDP login | Rare | Medium |
| 13 | CachedUnlock | Cached unlock | Laptop unlock | Low |
