Windows logon type 5

What is logon type 5?

Logon type 5 represents a service logon triggered by the Service Control Manager (SCM). It occurs when a Windows service runs under a user or managed service account instead of built-in accounts like LocalSystem. These logons are automatically recorded in the Windows security event logs.

Common scenarios for logon type 5 (service logon):

1. Automatic service startup: Core services launching at boot; for example, Windows Update and Print Spooler.
2. Service installation: New services registered during software setup; for example, antivirus and monitoring tools.
3. Manual service start: Services launched by administrators using tools like Services.msc, sc start, or PowerShell.

How to spot logon type 5:

In Event Viewer, under Windows Logs > Security, look for:

• Event ID: 4624
• Logon Type: 5
• Account Name under New Logon; this is the service account being used
• Account Domain to see where the account belongs

While 4624 is the main event ID, you may also encounter:

Understanding the Advapi logon process

When reviewing service logon events, you may notice the Logon Process field set to Advapi or Advapi32. This refers to the Advanced Windows 32 Base API, a core component that handles secure authentication and service startup on behalf of the SCM.

For logon type 5, this entry indicates that the service was started locally by the operating system using trusted Windows APIs rather than through remote calls or third-party processes.

Why it matters:

• It confirms that the logon was triggered internally by Windows, not remotely or interactively.
• It helps validate that the logon process followed the expected secure path.
• It supports investigations by showing that service startup was system-driven, not user-initiated.

This logon process is normal and expected for legitimate Windows services using user or managed service accounts.

Note: For logon type 5, this typically means a local service startup. However, Advapi can also appear in other logon types, so always consider it alongside fields like Logon Type, Account Name, and Process ID to understand the context.

Why should logon type 5 events be monitored?

• Windows logon type 5 events indicate when a service authenticates using a designated user account, often without direct user interaction.
• Monitoring these events helps ensure that only authorized services are running under the correct accounts.
• Unexpected or unusually frequent logon type 5 events may point to unauthorized service startups or misuse of service accounts.
• Maintaining logs of service-level authentications is required for compliance with standards like the PCI DSS and HIPAA.
• It also helps maintain system integrity and provides a reliable audit trail for forensic investigations after a security incident.