The logon type is an attribute of Windows Security event logs, most notably security event logs with Event ID 4624. The table provides a list of the logon types that are included and excluded by the Logon Tracker module. The Int column represents the integer value seen in the Windows event log (only useful to forensic analysts familiar with these values). The Included column indicates whether the type is included based on the default Logon Tracker settings.
Logon Type | Int | Included? | Description |
|---|---|---|---|
Interactive | 2 | N | User logging in at keyboard. |
Network | 3 | Y | A very broad type that includes activity such as mapping network shares and running commands on remote systems |
Batch | 4 | N | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
Service | 5 | N | A service started by the Service Control Manager. |
Unlock | 7 | N | This workstation unlocked. |
NetworkCleartext | 8 | N | A user logged on to this computer from the network. The user's password passed on to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plain text. NoteNetworkCleartext logons are generated when IIS (Internet Information Services) is configured to use HTTP basic authentication. This can be noisy depending on how IIS is used in an environment but could also capture interesting logon information. Depending on your planned usage of LT, you may want to consider removing this value from the default filters (see Configuring Logon Tracker Agent Policy for more information). |
NewCredentials | 9 | N | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity but uses different credentials for other network connections. |
RemoteInteractive | 10 | Y | User logon via RDP. |
CachedInteractive | 11 | N | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
For more information on EID 4624 logon types, see the Microsoft documentation.