Event ID 4624 and Logon Types: Who Signed In to a Windows PC

Why This One Event Matters

Event 4624 — "An account was successfully logged on" — is the backbone of nearly every Windows investigation. It is where you establish who was on the machine, from where, and how.

The event ID alone is not the useful part. Every machine generates hundreds of 4624 events a day, most of them the local SYSTEM account doing routine work. The field that turns noise into evidence is Logon Type.

The Logon Types

| Type | Name | What it means | |---|---|---| | 2 | Interactive | Someone signed in at the keyboard | | 3 | Network | Access to a share or resource over the network | | 4 | Batch | A scheduled task ran as this account | | 5 | Service | A service started as this account | | 7 | Unlock | An existing session was unlocked or reconnected | | 8 | NetworkCleartext | Network logon with the password sent in cleartext | | 9 | NewCredentials | runas /netonly — different credentials for network access | | 10 | RemoteInteractive | Remote Desktop | | 11 | CachedInteractive | Signed in using cached domain credentials, no DC reachable |

The ones that answer real questions

Type 2 — a person, physically present. On a home machine this is the normal daily logon. A type 2 at a time the owner says they were out is a straightforward finding.

Type 10 — Remote Desktop. On a machine that should not have RDP enabled, a single type 10 is a serious event. Cross-reference with the RDP session logs.

Type 3 — the noisiest and most misread. Network logons happen constantly and legitimately: file share access, printer connections, background authentication. Almost always benign in volume. It becomes interesting when the account is one that should never authenticate over the network, or when it comes from an unexpected source address.

Type 8 — rare, and worth a hard look. Cleartext credentials over the network usually means a legacy application or basic authentication. It is also what credential-harvesting setups produce.

Type 9 — runas /netonly. Uncommon in normal use and a well-known pattern in lateral movement, where an attacker uses stolen credentials for network access while keeping their local session. On a home machine, essentially never legitimate.

Type 11 — cached domain credentials. On a laptop off the corporate network this is routine. On a desktop that never leaves the office, it can indicate the machine was moved or the domain controller was unreachable.

Reading the Event

Step 1: Filter the Security log to 4624

Event Viewer → Windows Logs → Security → Filter Current Log → Event ID 4624.

Immediately filter out the noise. SYSTEM, LOCAL SERVICE, NETWORK SERVICE and accounts ending in $ (machine accounts) make up the overwhelming majority of entries and are almost never what you want.

For anything beyond casual browsing, use EvtxECmd to convert the log to CSV and work in Timeline Explorer instead — Event Viewer's filtering is slow and awkward at volume:

EvtxECmd.exe -f C:\Windows\System32\winevt\Logs\Security.evtx --csv C:\cases\out --csvf security.csv

Step 2: Read the four fields that matter

In each 4624:

• Logon Type — the table above.
• Account Name under New Logon — who signed in. Note there are two account fields in the event; the Subject section is the account that requested the logon, which for interactive logons is usually SYSTEM.
• Source Network Address — where from. - or 127.0.0.1 means local. An external address on a home machine is significant.
• Logon ID — a hex value unique to this session. Keep it.

Step 3: Use the Logon ID to track the whole session

The Logon ID is the thread that ties a session together. Search the log for it and you get:

• 4634 — the logoff, giving you session duration
• 4688 — every process created during that session, if command-line auditing is on
• 4672 — special privileges assigned, which marks an administrative logon

That last one is worth its own filter: 4672 immediately following a 4624 means the account signed in with administrative privileges. For a standard user account, that combination should not exist.

Step 4: Check failures alongside successes

Event 4625 is a failed logon. The relationship between 4625 and 4624 is often the whole story:

• Many 4625 from one source, then one 4624 from the same source — successful password guessing. Treat as confirmed compromise.
• 4625 with Status 0xC0000064 — the username does not exist. Someone is guessing account names.
• 4625 with Status 0xC000006A — correct username, wrong password.
• 4625 with Status 0xC0000234 — account locked out.

Step 5: Establish your retention window before concluding anything

The Security log has a size cap and rotates. Before you conclude "there were no remote logons", find the oldest event in the log and state your window explicitly. On a busy machine the Security log can cover less than a day.

Get-WinEvent -LogName Security -Oldest -MaxEvents 1 | Select-Object TimeCreated

If that returns yesterday, your investigation covers yesterday. Say so, and pivot to artifacts with independent retention — Prefetch, SRUM, Amcache.

Turning This Into Detection

If you administer the machine and want this to be useful next time rather than only after the fact:

• Raise the Security log size. Event Viewer → right-click Security → Properties → maximum log size 512 MB or more. The default fills fast.
• Alert on Logon Type 10 for machines that should not accept RDP.
• Alert on Logon Type 9 anywhere outside a known administrative workflow.
• Alert on 4624 followed by 4672 for a non-administrative account.
• Baseline first. Every one of these fires on normal activity somewhere in a real environment. Watch for a week before you decide what is anomalous.

Related

• How to tell if a Windows 11 PC was remotely accessed
• 30-minute triage of a suspected-compromised PC
• Consumer guide: recovering a hacked Microsoft account

FAQ

What is the difference between Logon Type 2 and Type 10?

Type 2 is an interactive logon at the physical keyboard. Type 10 is RemoteInteractive — a Remote Desktop session. Both give a full desktop; the difference is whether the person was in front of the machine. Type 7 sits alongside both and indicates an existing session was unlocked or reconnected rather than newly created.

Why are there hundreds of 4624 events with no user involved?

Most 4624 events are the SYSTEM, LOCAL SERVICE and NETWORK SERVICE accounts, plus machine accounts ending in $, performing routine background work — service starts, scheduled tasks, and network authentication. Filter these out first; what remains is usually a manageable number of real logons.

Does 4624 record the password used?

No. No Windows event records a password in any form. 4624 records the account name, domain, logon type, source address, authentication package, and a session Logon ID. Logon Type 8 (NetworkCleartext) indicates the password was transmitted in cleartext to the authenticating system — but it is still not written to the event log.

How long does the Security log keep events?

Until the log reaches its configured maximum size, then the oldest events are overwritten. Defaults are small enough that an active machine can cycle through the whole log in under a day. Always establish the oldest event present before treating an absence of events as evidence that nothing happened.