4634 - Account Logoff

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634

Event ID 4634 is a significant event in the Windows security auditing subsystem, indicating an account logoff. This event is logged whenever a logon session is terminated and can be seen across various scenarios, such as user-initiated logoffs, system shutdowns, or when a network session is closed. Monitoring and analyzing these logoff events is crucial for understanding user activity patterns, detecting potential security issues, and ensuring compliance with organizational policies.

Key Details of Event ID 4634

• Log Location: Security log.

  • %SYSTEM ROOT%\System32\winevt\logs\Security.evtx

• Category: Audit Logoff

• Level: Information.

When It Is Logged

Event ID 4634 is generated in several scenarios, including but not limited to:

• A user logs off from a system interactively.

• A remote desktop session is disconnected or logged off.

• A network session to a shared resource is closed.

• Scheduled tasks or services running under a specific account are stopped.

Information Contained in the Log

An Event ID 4634 log contains important information that helps in identifying the context of the logoff event:

• Logon Type: This indicates the type of logon session that was terminated. The logon type provides context, such as whether the logoff was from an interactive session, a network connection, or a remote desktop session.

• Subject: Details about the account that logged off.

  • Security ID: The SID of the account.

  • Account Name: The name of the account.

  • Account Domain: The domain of the account.

  • Logon ID: A unique identifier for the logon session. This ID can be used to correlate with other events, such as a corresponding Event ID 4624 (logon event).

• Target Logon ID: Identifies the session that was terminated.

Importance for Security

Understanding and monitoring Event ID 4634 is vital for several reasons:

• User Activity Monitoring: Tracking logoff events helps in creating a baseline of normal user activity and identifying deviations that could indicate security issues, such as unauthorized access or insider threats.

• Security Investigations: During forensic analysis, correlating logoff events with other security events can provide insights into the actions taken by a user or an attacker before exiting the system.

• Compliance and Auditing: Many compliance frameworks require detailed logging of user activities, including when users log off. Analyzing these events can help organizations meet their compliance obligations.

Tools and Strategies for Analysis

• Windows Event Viewer: The Event Viewer allows administrators to manually review and filter Event ID 4634 logs.

• PowerShell: Administrators can use PowerShell to automate the collection and analysis of logoff events, making it easier to handle large volumes of data or perform regular audits.

• SIEM Systems: Security Information and Event Management (SIEM) systems can aggregate logoff events from across an organization, enabling more sophisticated analysis, correlation with other events, and real-time alerting on suspicious activities.