Event ID 4634LogonP1
Windows Event ID 4634: An account was logged off
Windows Security Event ID 4634 records termination of a logon session and helps bound the duration of user and service activity.
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-10
Trigger Scenarios
Windows writes the event when a logon session ends because of user sign-out, shutdown, disconnect, or service termination.
Key Fields
Subject
The account associated with the ending session.
Logon Type
The session type, such as network or RemoteInteractive.
Logon ID
Use this identifier to correlate the event with 4624 and related activity.
Common False Positives
- Normal session completion generates frequent events.
- Service and network sessions can end rapidly under normal application behavior.
Related Events
MITRE ATT&CK Mapping
- T1078Valid Accounts
Detection Notes
For T1078 Valid Accounts timeline reconstruction, pair 4634 with its 4624 by Logon ID. A Type 10 session that has no 4647 user-initiated logoff but ends after suspicious 4688 activity can indicate disconnect or forced session cleanup; the exact Logon Type distinguishes RDP from SMB Type 3 activity.
SecurityEvent
| where EventID in (4624, 4634)
| project TimeGenerated, EventID, Computer, Account, LogonType, TargetLogonId
| order by TimeGenerated ascindex=wineventlog EventCode=4634
| table _time, host, TargetUserName, LogonType, TargetLogonIdTarget Account: CORP\jsmith
Logon Type: 10
Logon ID: 0x1a2b3c