Windows Security Log Event ID 4609

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
System
 • Security State Change
Type Success
Corresponding events
in Windows 2003
and before
513  
Discussions on Event ID 4609
Audit / Event 4609 / generate event when shutdown server in (in SECURITY)

4609: Windows is shutting down

On this page

Despite the documentation, as of Release candidate 1 this event is not found. Perhaps this is because the event logging service stops first (event 1100). This is funny since the same problem used to happen in NT.  MS fixed it in 2000 and looks like they broke it again at least as of RC1. I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 4609

Windows is shutting down. All logon sessions will be terminated by this shutdown.

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources