Mini-guide: the five fields of a 4624 that decide what a logon means

A successful logon is the most common event in the Security log and the one most often misread. This is the order to read it in.

The example

An invented event from MARL-FS-01 at Marlowe and Fenn Surveyors, trimmed to the fields that matter.

Event ID 4624   2026-09-02T22:14:09Z   Computer: MARL-FS-01.marlowe-fenn.example

Subject:
  Account Name:            -
  Logon ID:                0x0
Logon Information:
  Logon Type:              3
  Elevated Token:          Yes
New Logon:
  Account Name:            adm.tamsin
  Account Domain:          MARLOWEFENN
  Logon ID:                0xAA01BFE
Network Information:
  Workstation Name:        ENG-WS-077
  Source Network Address:  10.40.7.49
Detailed Authentication Information:
  Authentication Package:  NTLM
  Package Name (NTLM only): NTLM V2

1. Logon Type: how, which decides what was left behind

Type 3 is a network logon: a file share, remote administration, most lateral movement. The detail that matters is that a type 3 logon does not leave reusable credentials on this machine. Type 10, Remote Desktop, does. So does type 2.

That changes the response. If an administrator's account made a type 10 logon to a compromised server, their credentials were in its memory and the account needs resetting. If it was type 3, they were not.

Type 9 deserves a flag of its own. It is what runas /netonly produces, and it is also what common pass-the-hash tooling produces, with the logon process recorded as seclogo.

2. New Logon, not Subject

The account that logged on is under New Logon. Subject is the account that requested the logon, which for a network logon is blank, and for a service start is the machine itself. Reading the wrong block is the most common mistake with this event, and it produces reports in which the server logged on to itself.

3. Logon ID: the thread through everything else

0xAA01BFE is unique on this machine until it reboots. Every process this session starts carries it in event 4688, the privileges it received are in a 4672 with the same value, and the 4634 or 4647 that ends the session carries it too. It is how "an administrator logged on" becomes "this logon ran these six commands".

With User Account Control, an administrator's interactive logon produces two 4624 events, one for the full token and one for the filtered one, joined by a Linked Logon ID. Follow both.

4. Source Network Address and Workstation Name: one you can trust more than the other

The address is what the server saw on the wire. The workstation name is supplied by the client in NTLM authentication, and an operator's tooling can put anything there. Default names from attack tools and mismatches between name and address are both findings.

Expect blanks. A local logon shows a dash, ::1 or 127.0.0.1, and that is normal. For Kerberos, the workstation name is often empty and the address is the thing to use.

5. Authentication Package: Kerberos was available, so why NTLM?

In a domain, a logon between two members should normally be Kerberos. NTLM appears when the target was addressed by IP, when the client is not domain joined, and when the operator holds a hash and no password, because a hash can answer an NTLM challenge and cannot obtain a Kerberos ticket.

NTLM from a workstation to a server, by an administrative account, late in the evening, is exactly the event above. None of those facts is proof. Together they are worth the ten minutes it takes to look at ENG-WS-077.

Reading the example

An administrative account made a network logon to a file server over NTLM from a workstation, with an elevated token, at 22:14:00. Observed. What you do not know is who was at that workstation. The next step is there, not here: event 4648 on ENG-WS-077 at the same second names the account that supplied adm.tamsin's credentials.

The full table of logon types, and the events that pair with this one, are on the Windows event log cheat sheet.

Sources

The scenario above is invented. These are what its real half rests on.

• Microsoft Learn: 4624, An account was successfully logged on
• Microsoft Learn: 4648, A logon was attempted using explicit credentials
• Microsoft Learn: 4672, Special privileges assigned to new logon
• MITRE ATT&CK T1078, Valid Accounts