In a Windows security log, which of the following logon type codes is produced by someone logging on from a local keyboard?

In a Windows security log, which of the following logon type codes is produced by someone logging on from a local keyboard?

• 10
• 3
• 2
• 5 

 

EXPLANATION

The correct answer is 2. While Event ID 4624 shows a successful logon, you need to look at the event code to see the specific nature of that logon. You’ll see type 2 logons when a user attempts to log on at the local keyboard and screen, whether with a domain account or a local account from the computer’s local SAM.  Code 10 is for remote access, code 3 is from the network (for things such as accessing shares), and code 5 is used when a service starts up. For more information, See the source

SOURCE

http://www.windowsecurity.com/articles-tutorials/misc_network_security/Logon-Types.html