ZEKASTRA

SecurityLogon and session

4634 · An account was logged off

Generated when a logon session is terminated and no longer exists.

01Fields in the event

  • TargetUserSid
  • TargetUserName
  • TargetDomainName
  • TargetLogonId
  • LogonType

02How to use it

Match TargetLogonId to the 4624 that opened the session to estimate its duration. For interactive and remote interactive sessions, expect it together with 4647.

03Caveats

Requires Audit Logoff. Short network sessions may close long after use, so a missing 4634 is not proof that a session stayed open.

05Sources

  1. Microsoft Learn — 4634(S) An account was logged off checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.