Q&A

What is logon type 8?

Logon type 8: NetworkCleartext. A user logged on to this computer from the network. The user’s password was passed to the authentication package in its unhashed form. Such events may occur when a user logs on IIS (Internet Information Services) with basic access authentication method.

What are the different logon types?

In this article

Logon type	#	Authenticators accepted
Interactive (also known as, Logon locally)	2	Password, Smartcard, other
Network	3	Password, NT Hash, Kerberos ticket
Batch	4	Password (stored as LSA secret)
Service	5	Password (stored as LSA secret)

Is RDP logon Type 3?

According to my knowledge and test, the Logon Type value = 3 is expected for Terminal Service and RDP. You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access.

What is Advapi logon process?

The logon process is marked as “advapi”, which means that the logon was a Web-based logon through the IIS web server and the advapi process. If you are not hosting IIS websites, this might mean that the computer is infected.

What is special privileges assigned to new logon?

Special privileges were assigned to a new logon. If sensitive privileges are assigned to a new logon session, event 4672 is generated for that particular new logon. This event is generally recorded multiple times in the event viewer as every single local system account logon triggers this event.

What is special logon in Event Viewer?

The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged.

What is logon locally?

This right controls who can logon interactively at the local console of the computer. In Windows 2000 SP2, XP and 2003, Microsoft added the Allow logon through Terminal Services right and removed Terminal Services logon ability from Allow log on locally. The Deny logon locally logon right overrides this right.

What event ID is logon?

Event ID 4624 (viewed in Windows Event Viewer) documents every successful attempt at logging on to a local computer. This event is generated on the computer that was accessed, in other words, where the logon session was created.

What does the error code 0x0 indicate in a logon event?

If a credential validation attempt fails, you will see a Failure event with Error Code parameter value not equal to “0x0”….In this article.

Error Code	Description
0x0	No errors.

What is a special logon?

The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network.

What is a 4672 special logon?

4672: Special privileges assigned to new logon. This event lets you know whenever an account assigned any “administrator equivalent” user rights logs on. For instance you will see event 4672 in close proximity to logon events (4624) for administrators since administrators have most of these admin-equivalent rights.

What does it mean to have a logon type 8?

Research suggests that Logon Type 8 means: NetworkCleartext (Logon with credentials sent in the clear text. Most often indicates a logon to IIS with “basic authentication”)

Where can I find the OWA logon type 8 event?

Now, when the user morgan tries to connect the OWA client from his desktop “Morgan-PC” with wrong password, The logon failure event 4625 with logon type 8 will be logged in ExchSvr, and this event will points the Morgan-PC as Source Machine.

Where can I find the source port for logon type 8?

Status: 0xc000006d Sub Status: 0xc000006a Process Information: Caller Process ID: 0xce4 Caller Process Name: C:WindowsSystem32inetsrvw3wp.exe Network Information: Workstation Name: ExchSVR Source Network Address: 212.158.1.110 (Morgan-PC) Source Port: 40977 Logon Failure Event 4771 in Domain Controller: