Windows Event ID 4634 – Microsoft-Windows-Security-Auditing: An Account Was Logged Off

Start by examining the specific 4634 event details to understand the logoff context:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4634 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4634 in the Event IDs field and click OK
5. Double-click a 4634 event to view details including:
   • Subject Security ID: The account that logged off
   • Logon Type: How the user originally authenticated
   • Logon ID: Unique session identifier for correlation
6. Note the timestamp and compare with corresponding 4624 logon events to determine session duration

Use PowerShell to efficiently query and analyze 4634 events across multiple systems:

1. Open PowerShell as Administrator
2. Query recent logoff events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='LogonType';Expression={$_.Properties[4].Value}}

3. Filter events for specific users:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} | Where-Object {$_.Properties[1].Value -like '*username*'} | Format-Table TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}} -AutoSize

4. Analyze logoff patterns over time:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634; StartTime=(Get-Date).AddDays(-7)} | Group-Object @{Expression={$_.TimeCreated.Date}} | Select-Object Name, Count | Sort-Object Name

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} -MaxEvents 1000 | Export-Csv -Path "C:\Logs\Logoff_Events.csv" -NoTypeInformation

Ensure proper audit policy configuration to capture comprehensive logoff events:

1. Open Group Policy Management Console or Local Group Policy Editor (gpedit.msc)
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Audit Policies → Logon/Logoff
4. Configure Audit Logoff policy:
   • Right-click and select Properties
   • Check Configure the following audit events
   • Enable Success to capture normal logoffs
   • Enable Failure if investigating forced disconnections
5. Verify current audit settings via command line:

   auditpol /get /subcategory:"Logoff"

6. Apply settings and force Group Policy update:

   gpupdate /force

7. Test configuration by logging off and checking for new 4634 events

Investigate unusual logoff patterns by correlating 4634 events with system performance metrics:

1. Open Performance Monitor (perfmon.msc) to check system resource usage during logoff times
2. Create a custom Data Collector Set:
   • Right-click User Defined → New → Data Collector Set
   • Add counters for Memory, Processor, and Network utilization
   • Set collection interval to 1 second for detailed analysis
3. Query 4634 events with system context:

   $LogoffEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634; StartTime=(Get-Date).AddHours(-1)}
   foreach ($Event in $LogoffEvents) {
       $SystemLog = Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$Event.TimeCreated.AddMinutes(-2); EndTime=$Event.TimeCreated.AddMinutes(2)}
       Write-Output "Logoff at $($Event.TimeCreated): $($SystemLog.Count) system events nearby"
   }

4. Check for related system events around logoff times:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1074,6005,6006,6008} | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

5. Analyze Terminal Services events for RDP logoffs:

   Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'; Id=21,23,24,25} -MaxEvents 100

Set up automated monitoring for suspicious logoff patterns using Windows Event Forwarding and PowerShell:

1. Configure Windows Event Forwarding on collector server:

   wecutil qc /q
   winrm quickconfig -q

2. Create custom event subscription for 4634 events:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>Logoff-Monitoring</SubscriptionId>
     <Query>
       <Select Path="Security">*[System[EventID=4634]]</Select>
     </Query>
   </Subscription>

3. Deploy PowerShell monitoring script:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 4634" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       if ($Event.User -match 'Administrator|Domain Admin') {
           Send-MailMessage -To 'security@company.com' -Subject 'Admin Logoff Alert' -Body "Admin logoff detected: $($Event.User) at $($Event.TimeGenerated)"
       }
   }

4. Configure registry settings for enhanced logging:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "AuditBaseObjects" -Value 1
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "FullPrivilegeAuditing" -Value 1

5. Create scheduled task for daily logoff analysis:

   $Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\LogoffAnalysis.ps1'
   $Trigger = New-ScheduledTaskTrigger -Daily -At '06:00AM'
   Register-ScheduledTask -TaskName 'Daily Logoff Analysis' -Action $Action -Trigger $Trigger