EventCode 4625 LogonType 2 by Google Chrome

[burakatabay]

sourcetype="wineventlog" EventCode=4625 src=MachineX | table action, app, Caller_Process_Name, dvc, Logon_Type
my query is as above. Result is surprising. (dvc=MachineX)
Google Chrome Event 4625 and logontype 2 what does it mean ? ı dont understand ?

[burakatabay]

I guess you are right. It could be extansion. When ı look at the logs, I see advabi.dll this dll file manage the extansion and windows api services. Sorry for my bad english. thank you

[nickhills · Accepted solution]

Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.

To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields src_user dest_user.

I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.