Windows Security Log Event ID 551

Operating Systems Windows 2003 and XP
CategoryLogon/Logoff
Type Success
Corresponding events
in Windows 2008
and Vista
4647  
Discussions on Event ID 551
Ask a question about this event

551: User initiated logoff

On this page

A user that had logged on interactively (type 2) or by terminal services has started the logoff process. Event ID 538 will usually follow. If Event ID 538 does not follow, it could be that the system shut down before the process could complete or a program (or process) is not managing the access tokens correctly.

Free Security Log Resources by Randy

Description Fields in 551

  • User Name: %1
  • Domain: %2
  • Logon ID: %3 (corresponds to Logon ID in event 528, 538 and others.)

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Examples of 551

User initiated logoff:

User Name: wsmith
Domain:  ACME
Logon ID:  (0x0,0x28311)

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources