Event ID 4634 records that an account was logged off and the logon session no longer exists. It comes from the Security log and requires the Audit Logoff subcategory. Use it with Logon Type, Account Name, Security ID and Logon ID to understand session end times and correlate with 4624 activity.
What Event ID 4634 Tells You About Session Endings
Event ID 4634 marks the point where Windows considers an account logon session ended. On its own, that is not the same as a process exit or a user closing a window, but it is a useful boundary event for reconstructing when access stopped.
Because it records the end of a session, 4634 is most valuable when read alongside the earlier logon record and the surrounding authentication trail. Correlating it with the matching 4624 event helps separate a real session lifecycle from unrelated activity on the same host.
Why It Matters for Windows Security Logging
For investigators, 4634 helps answer a simple but important question: when did access end? That matters for incident timelines, user activity review, and identifying whether a session ended normally or at an unusual time. It also supports account attribution when several people or services use the same system.
The event is only useful when audit logging is configured correctly. If logoff auditing is missing, incomplete, or overwritten by volume, the session trail becomes fragmented and the analyst loses a clean start-and-stop view of activity. Windows Event Log Guide is a practical reference for how logon and logoff events fit into the broader Windows audit picture.
How Analysts Correlate Event ID 4634
4634 rarely stands alone. The most useful fields are Logon ID, Logon Type, Account Name, and Security ID, because together they connect the logoff event to the original session and to the context in which that session existed. That correlation is what turns a basic audit record into a timeline anchor.
In practice, analysts compare 4634 with logon success events, privilege-related events, and other host telemetry to understand whether the session was interactive, remote, service-driven, or short-lived. When available, Windows event data can be paired with process and network telemetry from tools such as Sysmon Guide to strengthen the timeline.
What Good Use Looks Like in an Investigation
Used well, 4634 helps establish who was active, for how long, and whether session end times align with expected behaviour. That makes it useful for insider-risk reviews, lateral-movement analysis, after-hours access checks, and validating whether a shared system was used within an approved window.
It is also a reminder that Windows logging is about correlation, not single-event conclusions. A lone logoff record does not prove harmless activity or compromise; it becomes meaningful when compared with the surrounding session history and with other host evidence. For teams that rely heavily on PowerShell and remote administration, PowerShell Security Guide provides additional context on how script activity can appear in the same investigative timeline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | 4634 depends on Windows audit logging for session-end visibility. |
| AU-6 — Audit Record Review, Analysis, and Reporting | 4634 is most useful when reviewed with matching logon events and other host telemetry. | |
| Recommendation — Ensure audit records are generated for logoff events and retained for correlation. Review logoff records with related authentication and endpoint evidence to reconstruct session timelines. | ||
| ISO/IEC 27001:2022 | A.8.15 — Logging | Event ID 4634 is a logging artifact used to evidence session termination. |
| A.8.16 — Monitoring activities | The event gains value when monitored and correlated for security analysis. | |
| Recommendation — Configure and retain logs that capture session end events needed for investigation and monitoring. Correlate logoff events with adjacent activity to detect unusual session patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Session-end events are part of the log data CIS expects organisations to manage and review. |
| Recommendation — Collect, protect, and review logoff events as part of central audit log management. | ||