I noticed the description says this eventid (540) only happens for logon type 3. This isn't true as it also happens for Logon type 8 (NetworkClearText - most likely a Basic Authentication to IIS).
Is this right? Does EventID 528 ever show Logon type 8? Do any other logon types show on EventID 540?
You are right. We knew about this but neglected to document. Logon Type 8 only shows up for 540 - not 528. The only time I've observed logon type 8 was the scenario you mentioned - IIS basic authentication - but I suppose it could show up with down-level SMB session authentication with old SAMBA clients but I can't say for sure.