Windows Event ID 4109 – Microsoft-Windows-Wininit: User Logoff Notification

Start by examining the specific details of Event ID 4109 to understand the logoff context and identify any patterns.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4109 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4109 in the Event IDs field and click OK
5. Double-click on recent Event ID 4109 entries to examine details including:
   • Subject Security ID and Account Name
   • Logon Type (Interactive, Network, Service, etc.)
   • Authentication Package
   • Workstation Name
   • Process Information
6. Note the timestamp patterns and frequency of logoff events
7. Cross-reference with Event ID 4624 (logon) and 4634 (logoff) for complete session tracking

Use PowerShell to extract and analyze Event ID 4109 data for patterns, anomalies, and correlation with other security events.

1. Open PowerShell as Administrator
2. Query recent Event ID 4109 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4109} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Extract detailed event properties for analysis:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4109} -MaxEvents 100
   $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           UserSID = $Event.Event.EventData.Data[0].'#text'
           UserName = $Event.Event.EventData.Data[1].'#text'
           LogonType = $Event.Event.EventData.Data[4].'#text'
           ProcessName = $Event.Event.EventData.Data[9].'#text'
       }
   } | Format-Table -AutoSize

4. Correlate with logon events to track session duration:

   $LogoffEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4109} -MaxEvents 20
   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 50
   
   # Compare timestamps and user accounts for session analysis

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4109} -MaxEvents 1000 | Export-Csv -Path "C:\Temp\Event4109_Analysis.csv" -NoTypeInformation

Enhance Event ID 4109 logging by configuring advanced audit policies to capture more detailed logoff information and related security events.

1. Open Local Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies
3. Configure Logon/Logoff audit subcategories:
   • Audit Logoff: Set to Success
   • Audit Logon: Set to Success and Failure
   • Audit Other Logon/Logoff Events: Set to Success and Failure
4. Apply settings using command line for multiple systems:

   # Enable detailed logoff auditing
   auditpol /set /subcategory:"Logoff" /success:enable
   auditpol /set /subcategory:"Logon" /success:enable /failure:enable
   auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

5. Verify current audit policy settings:

   auditpol /get /category:"Logon/Logoff"

6. Configure Security log size to accommodate increased logging:

   # Increase Security log size to 100MB
   wevtutil sl Security /ms:104857600

7. Test the configuration by performing a logoff and verifying Event ID 4109 appears with enhanced details

Implement automated monitoring for Event ID 4109 to detect unusual logoff patterns and potential security incidents.

1. Create a PowerShell monitoring script:

   # Save as Monitor-Event4109.ps1
   param(
       [int]$CheckIntervalMinutes = 15,
       [int]$AlertThreshold = 10
   )
   
   while ($true) {
       $StartTime = (Get-Date).AddMinutes(-$CheckIntervalMinutes)
       $Events = Get-WinEvent -FilterHashtable @{
           LogName='Security'
           Id=4109
           StartTime=$StartTime
       } -ErrorAction SilentlyContinue
       
       if ($Events.Count -gt $AlertThreshold) {
           $Message = "High logoff activity detected: $($Events.Count) Event ID 4109 entries in last $CheckIntervalMinutes minutes"
           Write-EventLog -LogName Application -Source "Custom Monitor" -EventId 1001 -EntryType Warning -Message $Message
           # Add email notification or SIEM integration here
       }
       
       Start-Sleep -Seconds ($CheckIntervalMinutes * 60)
   }

2. Register the script as a scheduled task:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-Event4109.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   
   Register-ScheduledTask -TaskName "Monitor Event 4109" -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings

3. Configure Windows Event Forwarding for centralized monitoring:

   # On collector server, create subscription
   wecutil cs event4109-subscription.xml

4. Create custom Windows Performance Toolkit (WPT) counters for logoff rate monitoring
5. Integrate with existing SIEM solutions using Windows Event Forwarding or log shipping agents
6. Set up dashboard visualization using tools like Grafana or Power BI for trend analysis

Perform comprehensive forensic analysis of Event ID 4109 for security incident investigation and compliance reporting.

1. Export comprehensive event data for analysis:

   # Export events with full XML details
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4109} -MaxEvents 5000
   $DetailedEvents = $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $EventData = $EventXML.Event.EventData.Data
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           EventId = $_.Id
           SubjectUserSid = $EventData[0].'#text'
           SubjectUserName = $EventData[1].'#text'
           SubjectDomainName = $EventData[2].'#text'
           SubjectLogonId = $EventData[3].'#text'
           LogonType = $EventData[4].'#text'
           ProcessId = $EventData[5].'#text'
           ProcessName = $EventData[6].'#text'
           IpAddress = $EventData[7].'#text'
           IpPort = $EventData[8].'#text'
       }
   }
   $DetailedEvents | Export-Csv -Path "C:\Forensics\Event4109_Detailed.csv" -NoTypeInformation

2. Correlate with other security events for timeline reconstruction:

   # Create comprehensive logon/logoff timeline
   $SecurityEvents = Get-WinEvent -FilterHashtable @{
       LogName='Security'
       Id=4624,4634,4647,4109
       StartTime=(Get-Date).AddDays(-7)
   } | Sort-Object TimeCreated
   
   $SecurityEvents | Select-Object TimeCreated, Id, @{Name='EventType';Expression={
       switch ($_.Id) {
           4624 {'Logon'}
           4634 {'Logoff'}
           4647 {'User Initiated Logoff'}
           4109 {'Wininit Logoff'}
       }
   }} | Export-Csv -Path "C:\Forensics\Security_Timeline.csv"

3. Analyze logoff patterns for anomaly detection:

   # Statistical analysis of logoff patterns
   $LogoffStats = $DetailedEvents | Group-Object SubjectUserName | ForEach-Object {
       $UserEvents = $_.Group | Sort-Object TimeCreated
       $TimeDiffs = for ($i = 1; $i -lt $UserEvents.Count; $i++) {
           ($UserEvents[$i].TimeCreated - $UserEvents[$i-1].TimeCreated).TotalMinutes
       }
       [PSCustomObject]@{
           UserName = $_.Name
           LogoffCount = $_.Count
           AvgTimeBetweenLogoffs = ($TimeDiffs | Measure-Object -Average).Average
           MinTimeBetweenLogoffs = ($TimeDiffs | Measure-Object -Minimum).Minimum
           MaxTimeBetweenLogoffs = ($TimeDiffs | Measure-Object -Maximum).Maximum
       }
   }
   $LogoffStats | Format-Table -AutoSize

4. Generate compliance reports with proper chain of custody documentation
5. Create incident response playbooks incorporating Event ID 4109 analysis procedures
6. Document findings using standardized forensic reporting templates