Windows Security Log Event ID 551

Operating Systems Windows 2003 and XP
Type Success
Corresponding events
in Windows 2008
and Vista

551: User initiated logoff

On this page

A user that had logged on interactively (type 2) or by terminal services has started the logoff process. Event ID 538 will usually follow. If Event ID 538 does not follow, it could be that the system shut down before the process could complete or a program (or process) is not managing the access tokens correctly.

Free Security Log Resources by Randy

Description Fields in 551

  • User Name: %1
  • Domain: %2
  • Logon ID: %3 (corresponds to Logon ID in event 528, 538 and others.)

Supercharger Free Edition


Examples of 551

User initiated logoff:

User Name: wsmith
Domain:  ACME
Logon ID:  (0x0,0x28311)

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources