Difference in Logon Type for Remote Desktop Connections Across Windows Versions

Question

I’m observing discrepancies in the logon types recorded for Remote Desktop (RDP) connections across different versions of Windows. Specifically:

• On Windows 7 and Windows 8, logon type 10 is used to indicate Remote Desktop connections.
• On Windows 10, it appears that Remote Desktop connections are recorded as logon type 3.

Could someone provide official documentation or resources that explain this change in logon types from Windows 7/8 to Windows 10? I’m looking for clarification on why this difference exists and how it reflects changes in Windows 10’s logging and security mechanisms.

Thank you!

Answer 1

Hello,

First, you can see all types here https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types

You can check if your authentication is different (NLA), when you enable it, the authentication occurs at client side, when you disable it, it occurs at server side.

Confirm your account type, if it is a local account, NTLM will be used, otherwise it most possibly

be kerberos as a domain authentication.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.