528SecuritySuccessful Logon:
User Name: <user name>
Domain: <domain name>
Logon ID: <logon identifier>
Logon Type: <logon type>
Logon Process: <logon process>
Authentication Package: <package name>
Workstation Name: <computer name>
This event is logged to the Security log when a successful log on occurs. The logoff event that accompanies this has the event id of 538.
Please see the additional link for an explanation of the Logon Type definitions.
The following logon types will appear in 528 events:
2: Interactive (console)
3: Network
4: Batch (task scheduler)
5: Service
7: Unlock
8: NetworkClearText (IIS)
9: NewCredentials (RunAs)
10: RemoteInteractive (RDP)
11: CachedInteractive (laptops)