sourcetype="wineventlog" EventCode=4625 src=MachineX | table action, app, CallerProcessName, dvc, Logon_Type
my query is as above. Result is surprising. (dvc=MachineX)
Google Chrome Event 4625 and logontype 2 what does it mean ? ı dont understand ?
Logon Type 2 is normally an 'interactive' logon, meaning that the process is trying to authenticate within a running session.
To help understand what is going on, you might want to look at the user account which is failing with 4625. If you have the windows TA available, you should be able include the fields srcuser destuser.
I have seen some browser plugins cause this in the past, and my guess is that the user in question will be SYSTEM, but see what shows up.