According to ref the logon types 10 and 3 in windows events are represnting
Logon Type 10 = RemoteInteractive Logon
&
Logon Type 3 = Network Logon
But when i tried to connect a Windows machine via "Remote Desktop Connection" with a wrong username and password, remote machine generating events with logon type 3 instead of 10. I checked with a lot machines. But still this is happening.
Could you explain why this happening?
log another details : event all details
Screenshots
Best Answer
You will get this logon type 3 when you are using NLA (Network Layer Authentication) as the authentication type since it will try and pre-authenticate you prior to giving you RDP access.
You can test this by changing the security layer to
RDP Security Layer
. Instructions and detailed information on how to do so are found here: Configure Server Authentication and Encryption Levels -- You should then find when typing an invalid username/password combination that it now logs it as logon type 10.