| 0 |
A system account is used to log on (e.g., Local System or Network Service) |
| 2 |
Physical login to the computer |
| 3 |
A login from the network |
| (Access via RDP , SMB , or network share (C$ , ADMIN$ , IPC$) ) |
|
| 4 |
Used by batch servers |
| (Used by scheduled tasks and scripts) |
|
| 5 |
Service (a Windows service started by service controller) |
| 6 |
Proxy (proxy logon; not used in Windows NT or Windows 2000) |
| 7 |
The workstation was unlocked (think Interactive logon, but unlocking to resume a previous session) |
| 8 |
NetworkCleartext (network logon with cleartext credentials) |
| 9 |
NewCredentials (used by RunAs when the /netonly option is used) |
| 10 |
A user logged in using terminal service or RDP |
| 11 |
A user logged in using stored network credential |