Windows EventInformation
Windows Event ID 5617 – Winlogon: User Logon Session Destroyed
Event ID 5617 indicates that a user logon session has been destroyed by the Windows Logon service, typically occurring during normal user logoff or session termination processes.
