Windows Forum

Ask something
Discussion Locked

NT4 Auditing - Logon Types

0 helpful
10 replies

by dcraun 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Does anyone out there have a list of what the logon types are in the security auditing section of the event viewer? I keep getting 4 invalid Admin login attempts every night. The logon type is 2. Some are logon type 7. I know some may be systemsaccounts, but I have searched in vain for a table listing the definition of each logon type.

thanks!

10 replies

by calves

I don't know what the logon types are, but if you're getting 4 every night, it's possible that it might be related to a service logon. rough guess!

Good luck!

by bpalmer

I don't know the logon types either, but I'd start by checking any jobs you have setup to run at night. Compare the times of the invalid login attempts to the times of jobs you have setup. Check things like tape backup, at jobs, antivirus updates,etc. Also check all the admin logs. Look for anything failing. Chances are you will find a match.

by scott.williams

The different logon types are:

2 Interactive
3 Network
4 Batch
5 Service
6 Proxy
7 Unlock Workstation
0 & 1 are invalid

Scott.

by scott.williams

If you want more info on security events goto the microsoft knowledge base and lookup artical-id: q174074
title: security event descriptions

by scott.williams

If you want more info on security events goto the microsoft knowledge base and lookup artical-id: q174074
title: security event descriptions

Scott.

This discussion is closed to new replies.