Windows Logon Types
The logon type Windows records on every sign-in event, which says how the session was established: at the keyboard, over the network, as a service, over remote desktop. Filtering on it is how a failed-sign-in spike separates a broken service account from a person at a console.
This table decodes 12 codes.
SparkLogs decodes these codes on every event that carries one, regardless of feed. The Windows Security event log feed reads these codes while curating an event.
How to read this
Codes are listed in numeric order. Windows publishes no constant for this space, so Name is the short label SparkLogs puts on the event, and it is what a question groups by. The last column is our one-line summary of what the code means in plain words.
Codes 0 to 13
| Code | Name | What it means |
|---|---|---|
0 | logon_system | used only by the operating system itself before anyone signs in |
2 | logon_interactive | signed in at the console keyboard |
3 | logon_network | reached the machine over the network |
4 | logon_batch | ran under the batch scheduler |
5 | logon_service | started as a Windows service |
7 | logon_unlock | unlocked an existing session |
8 | logon_network_cleartext | network logon with the password sent in cleartext |
9 | logon_new_credentials | ran with alternate credentials for network access |
10 | logon_remote_interactive | signed in over remote desktop |
11 | logon_cached_interactive | signed in with cached domain credentials |
12 | logon_cached_remote_interactive | signed in over remote desktop with cached credentials |
13 | logon_cached_unlock | unlocked an existing session with cached credentials |
Ask about these codes
Connect your AI and ask in plain language, or open the same events in Explore.