#user-logoff

2 articles

Windows Events2

Windows Security Event Viewer displaying Event ID 4647 user logoff events on a security monitoring dashboard

Windows Event ID 4647 – Microsoft-Windows-Security-Auditing: User Initiated Logoff

Event ID 4647 records when a user initiates a logoff from a Windows session. This security audit event tracks user-initiated disconnections for compliance and security monitoring purposes.

March 189 min

Windows Event Viewer displaying security audit logs with Event ID 4634 logoff events on a SOC monitoring dashboard

Event 4634

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 4634 – Microsoft-Windows-Security-Auditing: An Account Was Logged Off

Event ID 4634 records when a user account logs off from a Windows system. This security audit event tracks logoff activities for compliance and security monitoring purposes.

March 1812 min