> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/account-usage/crowdstrike-searches/event-name-userlogon.md).

# Event Name - UserLogon

**Description**

Platforms: *Linux, Windows, macOS*

This event is generated when a user logs on to a host.

Platforms: *ChromeOS*

Fields: Linux, Windows, macOS

| Field            | Description                                                                                                                                                                                                                                                                                                                                       |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ContextTimeStamp | System time of event creation.                                                                                                                                                                                                                                                                                                                    |
| UserName         |                                                                                                                                                                                                                                                                                                                                                   |
| LogonTime        |                                                                                                                                                                                                                                                                                                                                                   |
| LogonType        | <p>Values:</p><ul><li>INTERACTIVE (2)</li><li>NETWORK (3)</li><li>BATCH (4)</li><li>SERVICE (5)</li><li>PROXY (6)</li><li>UNLOCK (7)</li><li>NETWORK\_CLEARTEXT (8)</li><li>NEW\_CREDENTIALS (9)</li><li>REMOTE\_INTERACTIVE (10)</li><li>CACHED\_INTERACTIVE (11)</li><li>CACHED\_REMOTE\_INTERACTIVE (12)</li><li>CACHED\_UNLOCK (13)</li></ul> |
| UID              | Unix User Identifier.                                                                                                                                                                                                                                                                                                                             |
| UserIsAdmin      | Set to TRUE if this user is a local admin.                                                                                                                                                                                                                                                                                                        |
| PasswordLastSet  |                                                                                                                                                                                                                                                                                                                                                   |
| RemoteAddressIP4 |                                                                                                                                                                                                                                                                                                                                                   |
| RemoteAddressIP6 |                                                                                                                                                                                                                                                                                                                                                   |

<br>