Event ID 4634: An account was logged off
Written when a logon session ends. The Logon ID matches the 4624 that started it.
- Log
- Security
- Category
- Logon
Why it matters
- Pairing 4624 and 4634 by Logon ID gives the length of a session.
- Not always written: network sessions can end without one, so a missing 4634 proves little.
What to check
Match the Logon ID to its 4624 to work out session duration and what happened in between.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Logoff (Success).
Logon types
| Type | Name | Meaning |
|---|---|---|
| 2 | Interactive | At the keyboard or console. |
| 3 | Network | Over the network: file shares, many admin tools, PsExec, WMI. |
| 4 | Batch | Scheduled tasks. |
| 5 | Service | A service started by the Service Control Manager. |
| 7 | Unlock | Unlocking the workstation. |
| 8 | NetworkCleartext | Network logon with the password sent in cleartext, such as IIS basic authentication. |
| 9 | NewCredentials | runas /netonly: local identity unchanged, other credentials used for network access. |
| 10 | RemoteInteractive | Remote Desktop. |
| 11 | CachedInteractive | Logon with cached domain credentials, without contacting a domain controller. |
| 12 | CachedRemoteInteractive | Remote Desktop using cached credentials. |
| 13 | CachedUnlock | Unlock using cached credentials. |