Logon Type 10 is a Windows logon session created when a user connects remotely through Remote Desktop or Terminal Services. In event 4624, it shows remote interactive access rather than local console use. Defenders monitor it for unusual source hosts, odd hours, and RestrictedAdminMode changes that may indicate lateral movement.
What Logon Type 10 Means in Windows
Logon Type 10 is the Windows event log indicator for a remote interactive sign-in, most commonly associated with Remote Desktop or Terminal Services. It helps defenders distinguish remote access from local console activity and focus investigation on remote administration paths.
Why Logon Type 10 Matters for Detection
In practice, this logon type is useful because it marks a session that can be created from another host rather than from the keyboard and screen attached to the machine. That makes it one of the first places analysts look when they are trying to separate legitimate remote administration from suspicious access patterns.
When the same account appears with unusual source hosts, abnormal timing, or a change in remote admin settings, the logon record becomes a strong pivot point for triage. A concise reference for the surrounding Windows telemetry is the Windows Event Log Guide, which covers logon types alongside the key event IDs defenders use to investigate access and account activity.
How Analysts Use It in Windows Event Review
Logon Type 10 is rarely interpreted in isolation. Analysts usually pair it with the originating host, destination system, account name, session time, and companion events such as failed logons, explicit credential use, logoff events, and privilege changes to understand whether the session was expected.
The value of the field is that it narrows the investigation to remote interactive access, which is often the path used by administrators, help desks, and attackers alike. Context determines whether the event is normal remote work or evidence of lateral movement, stolen credentials, or remote control established after compromise.
Security Consequences of Remote Interactive Logons
Remote interactive sessions expand the attack surface because they can bridge one compromised system to another without physical access. If an attacker obtains valid credentials, a Type 10 session can provide a low-friction way to move laterally, access higher-value hosts, or test whether remote administration paths are open.
RestrictedAdminMode and similar remote desktop settings matter because they can alter how credentials are handled during a remote session. That makes configuration drift, unusual source systems, and unexpected remote access especially important signals in environments where remote administration is routine.
Risk and Threat Considerations
Logon Type 10 is often associated with legitimate administration, but it is also a common marker of lateral movement once credentials or a remote access path have been compromised. The risk is not the logon type itself, but the fact that it can represent trusted remote entry into a target system.
Failure mechanism: An attacker who acquires valid credentials, session material, or remote access configuration can establish a remote interactive session that looks operationally similar to ordinary administration, especially if the source host or time window is not scrutinized.
Impact: This can enable privilege escalation, reconnaissance, remote command execution, and movement to additional systems while blending into normal Windows logon activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021.001 — Remote Desktop Protocol | Type 10 commonly marks remote interactive access used in RDP-based lateral movement. |
| T1078 — Valid Accounts | Remote interactive logons often succeed with stolen or abused credentials. | |
| Recommendation — Map Type 10 remote sessions to RDP activity and hunt for lateral movement across hosts. Correlate Type 10 logons with valid-account abuse to investigate credential misuse. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor networks and systems to detect potential cybersecurity events | Logon Type 10 is a monitoring signal used to detect unusual remote access behavior. |
| PR.AA-05 — Identity and access credentials are managed, provisioned, activated, deactivated, and protected | Remote interactive access depends on controlled credentials and remote access paths. | |
| Recommendation — Baseline Type 10 patterns and alert on anomalous source hosts, times, or account behavior. Restrict and monitor credentials that can create remote interactive sessions. | ||
| NIST SP 800-53 Rev 5 | AC-17 — Remote Access | Type 10 directly describes remote interactive access controlled by remote-access policy. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Investigating unusual Type 10 sessions requires reviewing correlated audit records. | |
| Recommendation — Enforce remote-access controls and limit which hosts and users can create Type 10 sessions. Review correlated audit records to distinguish routine remote administration from suspicious access. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Remote interactive sessions require controlled account and remote-access permissions. |
| CIS-8 — Audit Log Management | Type 10 is detected through Windows security logging and log correlation. | |
| Recommendation — Review remote access entitlements and remove unnecessary pathways for Type 10 use. Collect and retain Windows logon telemetry so Type 10 activity can be investigated. | ||
Practitioner Guidance
What to watch for: Treat recurring Type 10 activity as a behavior to baseline, not a signal to ignore. The key question is whether the source host, account, and hour of day match the way remote administration is supposed to happen in your environment.
Practitioner note: Correlate Type 10 with account changes, remote desktop configuration, and adjacent authentication events before deciding whether it is benign. A single remote logon may be routine, but a pattern of new sources or unusual admin sessions deserves immediate review.