sysop@hub:~/cheat-sheets/event-id-reference$
event-id-reference
Common Windows event IDs for security and troubleshooting. Search by ID or keyword.
logon-types
The logon type in events 4624 and 4625 shows how a user signed in.
| Type | Name | Meaning |
|---|---|---|
| 2 | Interactive | Signed in at the keyboard or console. |
| 3 | Network | Access to a shared resource such as a file share, without an interactive session. |
| 4 | Batch | A scheduled task or batch job. |
| 5 | Service | A service started under an account. |
| 7 | Unlock | A locked workstation was unlocked. |
| 8 | NetworkCleartext | A network logon where the password was sent in clear text, for example basic authentication on IIS. |
| 9 | NewCredentials | Alternate credentials for network connections, for example runas /netonly. |
| 10 | RemoteInteractive | Remote Desktop or Terminal Services. |
| 11 | CachedInteractive | Logon with cached domain credentials because no domain controller was reachable. |
The list covers frequent events and is not complete. Availability depends on your audit policy and log settings.