{
  "id": "4634",
  "source": "windows_security",
  "category": "Logon",
  "name": "An account was logged off",
  "priority": "P1",
  "applicable_version": "Windows Server 2008 R2 and later; Windows 7 and later",
  "last_reviewed": "2026-07-10",
  "definition": "Windows Security Event ID 4634 records termination of a logon session and helps bound the duration of user and service activity.",
  "trigger_scenarios": "Windows writes the event when a logon session ends because of user sign-out, shutdown, disconnect, or service termination.",
  "key_fields": [
    {
      "field": "Subject",
      "explanation": "The account associated with the ending session."
    },
    {
      "field": "Logon Type",
      "explanation": "The session type, such as network or RemoteInteractive."
    },
    {
      "field": "Logon ID",
      "explanation": "Use this identifier to correlate the event with 4624 and related activity."
    }
  ],
  "false_positives": [
    "Normal session completion generates frequent events.",
    "Service and network sessions can end rapidly under normal application behavior."
  ],
  "related_event_ids": [
    "4624",
    "4647",
    "4778"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1078",
      "technique_name": "Valid Accounts"
    }
  ],
  "detection_notes": "For T1078 Valid Accounts timeline reconstruction, pair 4634 with its 4624 by Logon ID. A Type 10 session that has no 4647 user-initiated logoff but ends after suspicious 4688 activity can indicate disconnect or forced session cleanup; the exact Logon Type distinguishes RDP from SMB Type 3 activity.",
  "kql_snippet": "SecurityEvent\n| where EventID in (4624, 4634)\n| project TimeGenerated, EventID, Computer, Account, LogonType, TargetLogonId\n| order by TimeGenerated asc",
  "spl_snippet": "index=wineventlog EventCode=4634\n| table _time, host, TargetUserName, LogonType, TargetLogonId",
  "sample_log": "Target Account: CORP\\jsmith\nLogon Type: 10\nLogon ID: 0x1a2b3c",
  "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634",
  "route": "/windows-events/4634/",
  "canonical_url": "https://soceventlookup.com/windows-events/4634/",
  "json_url": "/api/events/windows-security/4634.json"
}