#session-management

Windows Event ID 5617 – Winlogon: User Logon Session Destroyed

Event ID 5617 indicates that a user logon session has been destroyed by the Windows Logon service, typically occurring during normal user logoff or session termination processes.

Windows Event ID 1532 – User32: Desktop Window Manager Session Ended

Event ID 1532 from User32 indicates the Desktop Window Manager (DWM) session has ended, typically during user logoff, system shutdown, or when switching between user sessions.