> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/event-ids/security/authentication-account/4634-account-logoff.md).

# 4634 - Account Logoff

Event ID 4634 is a significant event in the Windows security auditing subsystem, indicating an account logoff. This event is logged whenever a logon session is terminated and can be seen across various scenarios, such as user-initiated logoffs, system shutdowns, or when a network session is closed. Monitoring and analyzing these logoff events is crucial for understanding user activity patterns, detecting potential security issues, and ensuring compliance with organizational policies.

#### Key Details of Event ID 4634

* **Log Location**: Security log.
  * `%SYSTEM ROOT%\System32\winevt\logs\Security.evtx`
* **Category**: Audit Logoff
* **Level**: Information.

#### When It Is Logged

Event ID 4634 is generated in several scenarios, including but not limited to:

* A user logs off from a system interactively.
* A remote desktop session is disconnected or logged off.
* A network session to a shared resource is closed.
* Scheduled tasks or services running under a specific account are stopped.

#### Information Contained in the Log

An Event ID 4634 log contains important information that helps in identifying the context of the logoff event:

* **Logon Type**: This indicates the type of logon session that was terminated. The logon type provides context, such as whether the logoff was from an interactive session, a network connection, or a remote desktop session.
* **Subject**: Details about the account that logged off.
  * **Security ID**: The SID of the account.
  * **Account Name**: The name of the account.
  * **Account Domain**: The domain of the account.
  * **Logon ID**: A unique identifier for the logon session. This ID can be used to correlate with other events, such as a corresponding Event ID 4624 (logon event).
* **Target Logon ID**: Identifies the session that was terminated.

#### Importance for Security

Understanding and monitoring Event ID 4634 is vital for several reasons:

* **User Activity Monitoring**: Tracking logoff events helps in creating a baseline of normal user activity and identifying deviations that could indicate security issues, such as unauthorized access or insider threats.
* **Security Investigations**: During forensic analysis, correlating logoff events with other security events can provide insights into the actions taken by a user or an attacker before exiting the system.
* **Compliance and Auditing**: Many compliance frameworks require detailed logging of user activities, including when users log off. Analyzing these events can help organizations meet their compliance obligations.

#### Tools and Strategies for Analysis

* **Windows Event Viewer**: The Event Viewer allows administrators to manually review and filter Event ID 4634 logs.
* **PowerShell**: Administrators can use PowerShell to automate the collection and analysis of logoff events, making it easier to handle large volumes of data or perform regular audits.
* **SIEM Systems**: Security Information and Event Management (SIEM) systems can aggregate logoff events from across an organization, enabling more sophisticated analysis, correlation with other events, and real-time alerting on suspicious activities.