Analyst Resources
A Handy Reference for Windows Logon Types with Status and Substatus Codes
This list of logon types and status/substatus for Event ID 4625 comes from Microsoft documentation for threat-protection auditing, and is beneficial for analysts and people that are curious about what is going on in their PC. Logon type Logon title Description 2 Interactive A user logged on to this computer. Read more…
