Windows Authentication and Logon Types

Logon
Logon Type Example Logon Right
Number

0 Used only by the System account System startup.

Interactive: Used to log on at the local User logon at console at the beginning of the
2 Log on locally
console day.

Network: Used to access a Windows

One example is when a computer has a Access this computer
3 resource (e.g., shared folder) from a
mapped drive to another computer share. from the network
system on the network

Batch Job: Used to run a scheduled task

4 Task Scheduler or AT command. Log on as a batch job
as a specified account

Credentials for an account other than local

Service: Used to run a service as a
5 service can be used for services such as Log on as a service
specified account
Telnet.

6 Proxy

When a screen saver locks a system, the

Unlock (i.e. unattended workstation with
7 password must be entered to access the
password protected screen saver)
system at the console.

NetworkCleartext (Logon with credentials Most often indicates a logon to IIS with
8
sent in the clear text.) "basic authentication".

This logon type does not seem to show up in

NewCredentials such as with RunAs or
9 mapping a network drive with alternate
credentials.
any events. Microsoft explanation: Allows the
caller to clone its current token and specify
new credentials for outbound connections.
The new logon session has the same local
identify, but uses different credentials for
other network connections.

Terminal Services, Remote Desktop or Log on through

10 RemoteInteractive
Remote Assistance. Terminal Services

Logon that uses cached domain credentials

11 CachedInteractive (such as when logging on to a laptop when
away from the network).

Logon that occurs when the remote system

12 CashedRemoteInteractive
is away from the network DC.

Unlock that occurs when the remote system

13 CashedUnlock
is away from the network DC.