Windows security log logon type 2

You can tie this event to logoff events and using Logon ID. Identifies the account that requested the logon - NOT the user who just logged on. Subject is usually Null or one of the Service principals and not usually useful information.

See New Logon for who just logged on to the sytem. This is a valuable piece of information as it tells you HOW the user just logged on:. Logon Type Description 2 Interactive logon at keyboard and screen of system 3 Network i. Most often indicates a logon to IIS with "basic authentication" See this article for more information. This logon type does not seem to show up in any events. If you want to track users attempting to logon with alternate credentials see MS says "A caller cloned its current token and specified new credentials for outbound connections.

The new logon session has the same local identity, but uses different credentials for other network connections. Anonymous Anonymous COM impersonation level that hides the identity of the caller. Calls to WMI may fail with this impersonation level.

Default Default impersonation. Delegate Delegate-level COM impersonation level that allows objects to permit other objects to use the credentials of the caller. This level, which will work with WMI calls but may constitute an unnecessary security risk, is supported only under Windows Identify Identify-level COM impersonation level that allows objects to query the credentials of the caller. Impersonate Impersonate-level COM impersonation level that allows objects to use the credentials of the caller.

This is the recommended impersonation level for WMI calls. The user who just logged on is identified by the Account Name and Account Domain. You can determine whether the account is local or domain by comparing the Account Domain to the computer name. Account logon events are generated on domain controllers for domain account activity and on local devices for local account activity. If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on the workstation or server, and they generate an account logon event on the domain controller.

Additionally, interactive logons to a member server or workstation that use a domain account generate a logon event on the domain controller as the logon scripts and policies are retrieved when a user logs on.

For more info about account logon events, see Audit account logon events. If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a logon attempt succeeds. Failure audits generate an audit entry when a logon attempt fails. To set this value to No auditing , in the Properties dialog box for this policy setting, select the Define these policy settings check box and clear the Success and Failure check boxes.

The following table describes each logon type. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. They are only used after an account authentication such as user, computer, and service has already taken place. For network logon, the process does not use the initial logon dialog box to enter the credentials. Instead, already established credentials for the account are used, or credentials are collected using in a different way.

This is typically invisible to the user unless alternate credentials are used. Windows logs logon type 3 for network logons such as accessing shared folders, printers, GPOs, and most logons to IIS. For a scheduled task execution in Windows, the Scheduled Task service first creates a new logon session for the task so that it can run under the user account specified for that task.

Windows logs this logon attempt as logon type 4. Some job scheduling systems or other application, depending on their design, may also generate logon events with logon type 4.

Windows Logon Type 5 services are configured to run under specified user accounts individually.