TABLE 2: Some Logon Process Field Values
Logon Process Field Entry	Description
User32 or WinLogon\MSGina	A typical NT logon process occurred. Winlogon.exe and msgina.dll are the files that the NT authentication UI uses.
SCMgr	The NT Service Control Manager (SCM) logged on and started a service.
Advapi	An application called the LogonUser function to initiate a logon process.
MS.RADIU	The Remote Authentication Dial-In User Service (RADIUS) initiated a logon.
Ntlmssp	The NTLM authentication protocol Security Support Provider (SSP) initiated the logon.
IIS	Microsoft IIS initiated the logon (this situation occurs when you use anonymous access or basic authentication on the IIS level).