none
Event 4624 logon type 3 for RDP access ?

    Question

  • Hello Team,

    When i logon to windows client via RDP using my AD credentials (that client is in AD domain) i got event 4624 logon - but with type=3.

    This looks to be inconsistent with the documentation:

    https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

    Should not it be 10 ?

    Thanks,

    Michal

    Thursday, September 20, 2018 11:25 AM

Answers

All replies

  • Hi Kevin,

    Thanks for the help here.

    Does it mean that for RDP sessions Logon Type value = 3 is expected ?

    As per:

    https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

    3 Network A user or computer logged on to this computer from the network.
    10 RemoteInteractive A user logged on to this computer remotely using Terminal Services or Remote Desktop.

    I see type 3 for my 802.1x sessions using AD for auth/authz, but i would expect to see 10 for Remote Desktop - while i see 3. Is that correct ? Are you able to confirm that ?

    Or maybe that documentation is not clear ?

    Thanks,

    Michal

    Thursday, September 20, 2018 7:06 PM
  • Hi,

    Thank you for your posting in our forum. 

    According to my knowledge and test,  the Logon Type value = 3 is expected for Terminal Service and RDP. You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access.

    The following article for your reference: 

    https://social.technet.microsoft.com/Forums/windows/en-US/7c720600-5fcc-4278-ae24-7b7ab9850692/rdp-failed-logons-not-showing-as-4625-type-10?forum=winserverTS

    https://serverfault.com/questions/711007/windows-events-for-remote-desktop-logon-failure

    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Hope my information could help you.

    Best regards

    Julie 



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by teknet7 Friday, September 21, 2018 1:03 PM
    Friday, September 21, 2018 6:47 AM
    Moderator