According to ref the logon types 10 and 3 in windows events are represnting

Logon Type 10 = RemoteInteractive Logon &

Logon Type 3 = Network Logon

But when i tried to connect a Windows machine via "Remote Desktop Connection" with a wrong username and password, remote machine generating events with logon type 3 instead of 10. I checked with a lot machines. But still this is happening.

Could you explain why this happening?

log another details : event all details


enter image description here enter image description here

1 Answer 1


You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access.

You can test this by changing the security layer to RDP Security Layer. Instructions and detailed information on how to do so are found here: Configure Server Authentication and Encryption Levels -- You should then find when typing an invalid username/password combination that it now logs it as logon type 10.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.