> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success/logon-types.md).

# Logon Types

Logon Events provide very specific information regarding the nature of account authorizations on a system. In addition to date, time, username, hostname, and success/failure status of a logon, Logon Events also enable us to determine by exactly what means a logon was attempted.

{% code title="Location" overflow="wrap" %}

```
%SYSTEM ROOT%\System32\winevt\logs\Security.evtx
```

{% endcode %}

Event ID 4624

| Logon Type | Explanation                                               |
| ---------- | --------------------------------------------------------- |
| 2          | Logon via console                                         |
| 3          | Network Logon                                             |
| 4          | Batch Logon                                               |
| 5          | Windows Service Logon                                     |
| 7          | Credentials used to unlock screen; RDP session reconnect. |
| 8          | Network logon sending credentials (cleartext)             |
| 9          | Different credentials used than logged on user            |
| 10         | Remote interactive logon (RDP)                            |
| 11         | Cached credentials used to logon                          |
| 12         | Cached remote interactive (similar to Type 10)            |
| 13         | Cached unlock (similar to Type 7)                         |