When is Logon Type 10 logged?

What Logon Type 10 tells you in a 4624 event

Logon Type 10 is the Windows audit signal for a remote interactive logon, which usually means a user connected to the host through Terminal Services or Remote Desktop. That makes it more than a generic login event: it marks a remote administration path that can expand exposure if the session is unexpected, over-privileged, or coming from an untrusted source.

The value is most useful when you read it alongside the rest of the 4624 record rather than in isolation. The logon type identifies the access path, while the surrounding fields help you decide whether the session fits normal administration, remote support, or a path that should trigger scrutiny.

For a practical Windows logging reference, the Windows Event Log Guide covers logon types, Event ID 4624, and the related events that help you place Logon Type 10 in context.

How to interpret RestrictedAdminMode and related logon fields

RestrictedAdminMode is the field that helps separate a normal remote desktop session from a path that may expose credentials or make privilege use harder to trace. If the session is expected, the key question is whether it matches the approved administrative pattern for that host, account, and source system.

Use LogonType, RestrictedAdminMode, source workstation, account name, and time of day together. A single remote logon can be ordinary on a jump host and suspicious on an endpoint that should not accept remote administration. The same event can also be routine for support staff and high-risk for a server that should only be reached through tightly controlled access paths.

If you need broader context on whether the logon belongs to a legitimate administrative path or to an abuse pattern, Top 10 Online Fraud Attacks is useful background for understanding how account compromise and remote access abuse often appear in practice.

What to check when Logon Type 10 appears unexpectedly

The first operational check is whether audit logon logging is enabled and whether you are actually collecting the 4624 records from the target machine. If the telemetry is incomplete, you may see the remote session without the surrounding evidence needed to judge whether it was approved, abused, or followed by lateral movement.

When the event is unexpected, validate the source, the account, the target system, and the timing against approved administration windows. Then look for follow-on activity such as privileged group use, service creation, remote tool execution, or repeated logons from the same origin, because Logon Type 10 often marks the start of an interactive remote session rather than the whole incident.

Risk and Threat Considerations

Remote interactive logons expand the attack surface because they create a direct administrative channel into a system. If an attacker obtains valid credentials or reaches a misconfigured remote access path, Logon Type 10 can be the visible trace of that foothold, especially when the session is not from an expected management host.

Failure mechanism: Remote Desktop access is accepted for an account or source that should not have it, or the session is allowed without sufficient logging context, so legitimate administration and hostile access look too similar to triage quickly.

Impact: An exposed remote logon path can enable privilege abuse, interactive command execution, and faster post-compromise movement, particularly when the account has elevated rights or the host is a high-value system.

Practitioner Guidance

What to verify: Confirm that 4624 events are being collected from the relevant systems and that the fields needed to interpret the session, especially LogonType and RestrictedAdminMode, are present and searchable.

Decision rule: If Logon Type 10 occurs on a system that should not receive remote interactive access, treat it as an exposure question first, then determine whether the access was approved, misrouted, or potentially abusive.

What practitioners underestimate: The event code alone does not tell you whether the session is safe, only that a remote interactive path was used. The real judgement comes from whether the source, account, and host combination matches your approved remote administration model.

Practitioner takeaway: Logon Type 10 is most valuable as a control signal, not a standalone alert, because its meaning depends on whether the remote session fits a known administrative pattern and is backed by complete audit logging.

Related resources from NHI Mgmt Group

• Type 3 Logon
• What are the core risks identified by the OWASP Agentic Top 10?
• Who is accountable when vendor sessions on OT systems are not fully logged?
• What breaks when organisations treat all keys as the same type of credential?