Ive got a question about the above field. Its presented in Windows auth logs. From what i know about Windows logs there are affectively 9 Types (2,3,4,5,7,8,9,10,11) So i setup alerts to pick up particular logontype failures. I've noticed I'm not getting any results at all apart from logontype 3. So I'm guessing this isnt the "LogonType" i thought it was? Any thoughts?