locked
Why does domain user log in with LogonType 3? RRS feed

  • Question

  • Hello,

     

    I'm developing a script that would list all logged in users. At first I've assumed that the correct LogonType for logged in users would be 2 (information from http://msdn.microsoft.com/en-us/library/aa394189(v=vs.85).aspx ):

     

    Interactive

    2

    Intended for users who are interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process.

     

    But as testing suggests the users log in with Type 3 (only on Windows XP, Windows 7 uses Type 2 in the same environment):

     

    Network

    3

    Intended for high-performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type.

     

     

     

    Can someone please elaborate what can affect the login type?

    Thank you. :)






    Thursday, August 11, 2011 4:00 PM

Answers

  • Assumption has been wrong, there are also cases when user logs in with cached domain credentials (in addition to type 3), so the best way would be just select all logged in users (excluding system accounts) instead of filtering them by type.

    Great read - http://www.windowsecurity.com/articles/logon-types.html


    • Marked as answer by HelloWorld51 Thursday, August 11, 2011 4:33 PM
    Thursday, August 11, 2011 4:33 PM