What is Windows Security log event Id 4624 type 9: New Credential Login

A 4624 Logon Type 9 event does not by itself mean someone remotely entered the workstation; it means a local process cloned its caller’s current token and supplied different credentials for subsequent outbound network connections.^1^

What “NewCredentials” means

The resulting process has two security identities:

• Local access: It retains the identity and permissions of the account that launched it.
• Network access: When it connects to another computer—such as a file server, SQL Server, or administrative share—it presents the newly supplied credentials.

The common example is:

runas /netonly /user:CONTOSO\AdminUser powershell.exe

The new PowerShell process still acts locally as the currently signed-in user, but attempts to use CONTOSO\AdminUser when accessing network resources. Microsoft describes this as cloning the current LSA session for local access while using new credentials for network connections.^2^

Type 9 also leaves reusable credentials in the Local Security Authority (LSA) session, so an unexplained event deserves investigation—particularly if it names a privileged account.^2^

Determine what created the after-hours event

Open Event Viewer → Windows Logs → Security, open the Type 9 event, and examine these fields:

1. Subject
   • Identifies the local account that requested the new session.
   • SYSTEM suggests that a service, management agent, or scheduled component initiated it; a named user identifies that user’s existing local session.
2. New Logon
   • Identifies the local identity assigned to the new logon session.
   • Record its Logon ID. That hexadecimal value can correlate related security events.^1^
3. Process Information
   • Process Name is the most important starting point. runas.exe, a script host, an administration utility, backup software, or another executable can explain who requested the session.
   • Check whether the path and digital signature match installed, approved software.
4. Network Account Name / Domain
   • On newer event versions, these fields identify the credentials designated for outbound traffic. Windows 10 added TargetOutboundUserName and TargetOutboundUserDomain specifically for this purpose.^3^
   • - or an unavailable value means the event alone may not identify the outbound account.
5. Events at the same time
   • Look for 4648, which records an attempted logon using explicit credentials.^4^
   • Look for 4688 to identify the process that started. Process-creation auditing must already have been enabled for this event to exist.^5^
   • Correlate events by timestamp, account, process ID, and Logon ID rather than relying on the event number alone.

This PowerShell query extracts recent Type 9 events without changing audit configuration:

$start = (Get-Date).AddDays(-7)

Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4624
    StartTime = $start
} | Where-Object {
    ([xml]$_.ToXml()).Event.EventData.Data |
        Where-Object { $_.Name -eq 'LogonType' -and $_.'#text' -eq '9' }
} | Select-Object TimeCreated, RecordId, Message

Run it from an elevated PowerShell session if access to the Security log is denied.

When to treat it as suspicious

Escalate the investigation if any of these are present:

• The process path is unknown, unsigned, user-writable, or no longer exists.
• The subject or outbound account is unexpected, disabled, or privileged.
• Type 9 events recur on a schedule that does not match approved tasks or management software.
• Related 4688 events show PowerShell, cmd.exe, script hosts, or unfamiliar binaries with unexplained command lines.
• The same time window contains unexpected outbound connections or successful logons on another computer under the outbound account.

Conversely, a recognized signed executable associated with an approved scheduled task, backup agent, deployment tool, or administrator workflow can legitimately generate Type 9 while nobody is physically present. The event proves that Windows created a credential-bearing logon session; it does not prove that those credentials were successfully used against another system.

References

1. 4624(S): An account was successfully logged on.
2. Administrative tools and logon types
3. What's new in Windows 10 Enterprise LTSC 2015
4. Windows security baseline
5. Advanced Audit Policy Configuration