| Code | Field | Name | Description |
|---|---|---|---|
| 2 | LogonType | Interactive | A user logged on to this computer. |
| 3 | LogonType | Network | A user or computer logged on to this computer from the network. |
| 4 | LogonType | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. |
| 5 | LogonType | Service | A service was started by the Service Control Manager. |
| 6 | LogonType | Proxy | Proxy logon |
| 7 | LogonType | Unlock | This workstation was unlocked. |
| 8 | LogonType | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). |
| 9 | LogonType | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. |
| 10 | LogonType | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. Important: When NLA is enabled, failed RDP logins generate logon type 3 (network), not 10. |
| 11 | LogonType | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. |
| 12 | LogonType | CachedRemoteInteractive | RemoteInteractive logon using cached credentials. |
| 13 | LogonType | CachedUnlock | Interactive or RemoteInteractive session unlock using cached credentials. |