Logons: 4624, 4625 & Logon Types
What is it?
4624 is a successful logon, 4625 a failed one. The LogonType field says HOW: 2 interactive (at the keyboard), 3 network (SMB/shares), 10 RemoteInteractive (RDP). The type reframes what a logon means.
Why it matters
A failed-then-successful 4625→4624 burst from one source is brute force; a Type-10 RDP logon from an unusual host is a lateral-movement lead. The type and outcome carry the meaning.
Where you see it
4625 rows with LogonType 3 and a Source IP; a 4624 with LogonType 10 names the RDP session; the Account and Computer fields tell you who and where.
What normal looks like
Interactive (2) logons at desks during hours; a few stray 4625 typos; service logons on their schedule.
What suspicious looks like
Many 4625 then a 4624 from one external source (brute force), or an off-hours Type-10 RDP from a workstation that never does RDP.
How analysts investigate
Group 4625 by source and account to spot a burst, read the LogonType to understand the vector, and check whether a success followed the failures from the same source.
Common beginner mistakes
- Ignoring LogonType — a network vs interactive logon means very different things.
- Treating a lone 4625 as an attack instead of a typo.
Success, failure, and how
4625 02:11 a.hakim src 203.0.113.66 LogonType 3 (fail)
4625 02:11 a.hakim src 203.0.113.66 LogonType 3 (fail x4)
4624 02:11 a.hakim src 203.0.113.66 LogonType 3 (SUCCESS)
→ failures then success from ONE external src = brute force in
LogonType: 2 interactive · 3 network · 10 RDPQuick check
Five 4625s then a 4624, all from one external IP for one account. What is it?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.