← cd ~/events
// events/4634 · Sign-in
Event ID 4634An account was logged off
The logon session has ended and no longer exists. It pairs with 4624 through the Logon ID, which is only unique until the next reboot.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Sign-in |
What to check
Correlate with 4624 on the same Logon ID to work out session length. Expect to see 4647 alongside it when a user logs off normally.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4634 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4634
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Sign-in events
- Event ID 4624: An account was successfully logged on
- Event ID 4625: An account failed to log on
- Event ID 4647: User initiated logoff
- Event ID 4648: A logon was attempted using explicit credentials
- Event ID 4672: Special privileges assigned to new logon
- Event ID 4776: The computer attempted to validate the credentials for an account