Windows has multiple logon types and often appear in the Windows event logs – this is what they translate to.

Logon Type 0 = System Only
Logon Type 1 = unknown
Logon Type 2 = Interactive Logon
Logon Type 3 = Network
Logon Type 4 = Batch
Logon Type 5 = Service
Logon Type 6 = (proxy logon)
Logon Type 7 = Unlock Workstation
Logon Type 8 = Network Clear Text
Logon Type 9 = New Credentials
Logon Type 10 = Remote Interactive (Windows XP and newer operating systems only).
Logon Type 11 = Cached Interactive
Logon Type 12 = CachedRemoteInteractive
Logon Type 13 = CachedUnlock

If you know of anymore or what a Type 1 logon is – please let me know.

Posted by markparris

Microsoft MVP - Enterprise mobility.

2 Comments

  1. Sorry… I didn’t find type 1, but I did find two others that are not in your list:

    Logon Type 12 – CachedRemoteInteractive
    Logon Type 13 – CachedUnlock

    Source: http://msdn.microsoft.com/en-us/library/aa394189.aspx

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s