| Logon Type Number | Name | Description |
| 2 | Interactive | Logon interactively with keyboard and mouse sitting in front of the computer (also Logons over KVM-over-IP, IPMI Remote Consoles, etc.) |
| 3 | Network | Logons over network e.g. when accessing a network share or Logons to an IIS webserver (Basic Authentication is not included here –> Code 8) |
| 4 | Batch | Logons over Scheduled Tasks |
| 5 | Service | Service Logons (see services.msc –> Log On As) |
| 7 | Unlock | When password protected screen is unlocked the event is logged with logon type 7 |
| 8 | NetworkCleartext | Like type 3 but with password sent in cleartext (especially Basic Auth. with IIS) |
| 9 | NewCredentials | Program is started with RunAs /netonly option. The program is then started as local user but network ressources are accessed with the given user. |
| 10 | RemoteInteractive | Logon over Remote Desktop Session or Remote Assistance Session |
| 11 | CachedInteractive | Logon using locally cached domain credentials |