Logon Type 3 ^new^ May 2026

You will typically see Type 3 events in Windows Event Viewer under Event IDs 4624 (Success) or 4625 (Failure) during these activities: Chapter 5 Logon/Logoff Events

Understanding Logon Type 3 is essential for distinguishing between routine background tasks and potential security threats like lateral movement or brute-force attacks. What is Logon Type 3? logon type 3

Logon Type 3 occurs when a user or service accesses a computer across the network without physically interacting with the machine's console or starting a remote graphical session like RDP. Unlike interactive logons (Type 2), there is no desktop interface provided to the user. Common Scenarios for Logon Type 3 You will typically see Type 3 events in