Windows Security Log Event ID 4634

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Logon/Logoff
 • Logoff
Type Success
Corresponding events
in Windows 2003
and before
538  
Discussions on Event ID 4634
Logout RDP Session

4634: An account was logged off

On this page

Also see event ID 4647 which Windows logs instead of this event in the case of interactive logons when the user logs out.

This event signals the end of a logon session and can be correlated back to the logon event 4624 using the Logon ID.

For network connections (such as to a file server), it will appear that users log on and off many times a day. This phenomenon is caused by the way the Server service terminates idle connections.

If a user turns off his/her computer, Windows does not have an opportunity to log the logoff event until the system restarts. Therefore, some logoff events are logged much later than the time at which they actually occur.

ANONYMOUS LOGONs are routine events on Windows networks.

Microsoft's comments:
This event does not necessarily indicate the time that a user has stopped using a system. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all.

Logon Type: indicates how the user was logged on.  See 4624 for explanation of these codes.

Free Security Log Resources by Randy

Description Fields in 4634

Subject:

  •  Security ID:  %1
  •  Account Name:  %2
  •  Account Domain:  %3
  •  Logon ID:  %4
  •  Logon Type:   %5

Supercharger Free Edition

 

Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

Examples of 4634

An account was logged off.

Subject:
      Security ID:  ANONYMOUS LOGON
   Account Name:  ANONYMOUS LOGON
   Account Domain:  NT AUTHORITY
   Logon ID:  0x149be

Logon Type: 3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources