XDM_CONST.LOGON_TYPE

Cortex Data Model Schema Guide

Last date published
2024-04-14

A numeric value that indicates the type of logon session. See https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-logonsession.

Original

Mapped

Description

2

XDM_CONST.LOGON_TYPE_INTERACTIVE

Intended for users who are interactively using the machine, such as a user being logged on by a terminal server, remote shell, or similar process.

3

XDM_CONST.LOGON_TYPE_NETWORK

Intended for high-performance servers to authenticate clear text passwords. LogonUser does not cache credentials for this logon type.

4

XDM_CONST.LOGON_TYPE_BATCH

Intended for batch servers, where processes can be executed on behalf of a user without their direct intervention; or for higher performance servers that process many clear-text authentication attempts at a time, such as mail or web servers. LogonUser does not cache credentials for this logon type.

5

XDM_CONST.LOGON_TYPE_SERVICE

Indicates a service-type logon. The account provided must have the service privilege enabled.

6

XDM_CONST.LOGON_TYPE_PROXY

Indicates a proxy-type logon.

7

XDM_CONST.LOGON_TYPE_UNLOCK

This logon type is intended for GINA DLLs logging on users who are interactively using the machine. This logon type allows a unique audit record to be generated that shows when the workstation was unlocked.

8

XDM_CONST.LOGON_TYPE_NETWORK_CLEARTEXT

Preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers.

9

XDM_CONST.LOGON_TYPE_NEW_CREDENTIALS

Allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identify, but uses different credentials for other network connections.

10

XDM_CONST.LOGON_TYPE_REMOTE_INTERACTIVE

Terminal Services session that is both remote and interactive.

11

XDM_CONST.LOGON_TYPE_CACHED_INTERACTIVE

Attempt cached credentials without accessing the network.

12

XDM_CONST.LOGON_TYPE_CACHED_REMOTE_INTERACTIVE

Same as RemoteInteractive. This is used for internal auditing.

13

XDM_CONST.LOGON_TYPE_CACHED_UNLOCK

Workstation logon.