Windows Failed Logon Type 2 by A Remote Computer Account!

Question

I woke up to a creepy Windows event where the Server B used the Computer account$ of Server A to log on to Server B (itself).

The logon type is 2 and the destination process is of course "lsass.exe"

Why would a computer account request an interactive logon attempt type 2 instead of over the network type 3?

The failure reason is "The user has not been granted the requested logon type at this machine."

Answer 1

There are a couple of instances where a computer would use a type 2 logon instead of type 3:

1. KVM over IP is viewed as a type 2 logon.
2. Using "RunAs" without "/netonly" is a type 2 logon.
3. Before Logon Type 10 came into existence, RDP logons were type 2 logons. How old are these machines?

Answer 2

Type 2 logon is an interactive logon that means that someone tried to logon to your computer interactively. That means with user interaction normally by submitting a user / password in a logon screen...

If logon is successfully all applications that the user executes will be executed on the user's behalf.

If the logon is not interactively is normally considered type 3 if being done from the network. More than this is hard to provide as we might need to get access to more information.

To leave you with more information on the subject please check the bellow links.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787567(v=ws.10)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/bfc67803-2c41-4fde-8519-adace79465f6

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-authsod/64781df1-ee20-413e-b8c5-6511c90dbc30#gt_9360639b-135c-46dc-9f9e-85728008146f