Did You Know: The Logon Type in Windows Event 4624 Signals Whether Credentials Were Left Behind

LONDON - Every successful Windows logon writes Event ID 4624 to the Security log of the computer that was accessed, where the logon session was created, according to Microsoft's auditing reference for the event. Most analysts read the account name and the source address first. The Logon Type field deserves the same attention. Microsoft's guidance on administrative tools and logon types says that whether credentials are exposed to potential theft on a remote computer depends primarily on the Windows logon type used by the connection.

The 4624 reference, which Microsoft now keeps in its previous-versions Windows documentation, lists the values. Type 2 is Interactive, a user logged on to this computer. Type 3 is Network, a user or computer logged on to this computer from the network. Type 4 is Batch, type 5 is Service, a service started by the Service Control Manager, and type 7 is a workstation unlock. Type 8, NetworkCleartext, means the user's password was passed to the authentication package in its unhashed form. Type 9, NewCredentials, means a caller cloned its current token and specified new credentials for outbound connections. Type 10, RemoteInteractive, is a logon through Terminal Services or Remote Desktop, and type 11, CachedInteractive, is a logon with locally stored network credentials where the domain controller was not contacted.

Microsoft's administrative tools reference, part of its privileged access guidance for Windows Server, maps those numbers to credential risk. It lists Interactive, Batch, Service, NetworkCleartext, NewCredentials and RemoteInteractive as logon types that leave reusable credentials in the LSA session, meaning plaintext passwords, NT hashes or Kerberos tickets that could be used to authenticate to other network resources. Network logons do not, except when delegation is enabled, in which case Kerberos tickets are present. For scheduled tasks and services, the password is also saved as an LSA secret on disk.

The same reference translates everyday tools. A console logon, RunAs and a successful Remote Desktop session all leave reusable credentials on the destination. Net use, MMC snap-ins, PowerShell WinRM with Enter-PSSession and PsExec without explicit credentials use Network logons and do not, and Microsoft says most vulnerability scanners default to Network logons. PowerShell WinRM with CredSSP produces a NetworkCleartext logon that does expose credentials, and PsExec with explicit credentials creates both Network and Interactive logon sessions. The Audit Logon policy that produces 4624 also records 4625 for failed logons and 4648 when a process logs on by explicitly specifying an account's credentials, which Microsoft says most commonly happens with scheduled tasks or the RunAs command.

Microsoft's monitoring recommendations for 4624 turn the field into detections: watch for Logon Type 4 or 5 used by a member of a domain administrative group, alert when a type 10 logon by an account that must use Restricted Admin mode shows Restricted Admin Mode set to No, monitor Elevated Token set to Yes for administrator sessions, and flag NTLM where it should not be used. For responders, the logon type also answers a scoping question early. A type 3 logon by a compromised administrator account, recorded on the computer that was accessed, marks where the attacker went. A type 2 or type 10 logon shows where that account's credentials may now sit in LSASS memory, waiting for the next hop.