LogonType

EventData field on logon records (4624/4625) identifying how the session was established. Common values: 2 Interactive (console), 3 Network (SMB/RPC), 5 Service, 7 Unlock, 9 NewCredentials (runas /netonly), 10 RemoteInteractive (RDP), 11 CachedInteractive.