Event ID 4634 is logged when an account logon session is terminated and no longer exists. It is distinct from 4647, which records a user-initiated logoff. Use it with Logon Type, Account Name, Security ID and Logon ID to correlate session endings, and ensure Audit Logoff is enabled.
What Event ID 4634 Means in the Windows Security Log
event id 4634 marks the end of a logon session, so the key interpretation is that the session no longer exists, not necessarily that the user consciously chose to sign out. That distinction matters when you are reconstructing access timelines, because the event is about session termination, while nearby audit events often tell you how the session began and whether it ended cleanly.
Use the fields already in the event record to anchor the context. Logon Type helps you distinguish interactive, remote, network, or service-driven activity, while Account Name, Security ID, and Logon ID let you join the termination event back to the originating logon and any other related security records. For a broader reference on the surrounding Windows audit trail, see the Windows Event Log Guide.
In practice, 4634 is most useful when you compare it with the logon event that created the session and with 4647, which reflects a user-initiated logoff. When those events do not line up, the explanation is often operational rather than suspicious, for example a disconnected remote session, an expired session, a service stop, or a system shutdown that ended the token without a human logoff action.
How to Correlate 4634 with Other Logon and Logoff Evidence
Correlation starts with the Logon ID, because that is the most reliable join key for tying a session end back to the original sign-in. If you see 4634 without the expected preceding logon event, the gap may be in your collection window, your forwarding path, or your audit coverage rather than in the host itself. That is why event retention and forwarding quality matter as much as the event definition.
Logon Type adds the operational context that decides how you interpret the closeout. A 4634 tied to a remote interactive session usually points you toward endpoint activity and session management, while a service or batch context pushes you toward scheduled tasks, service accounts, or automation. If you are validating Windows telemetry quality or building a SIEM parser, the Sysmon Guide is useful for understanding how Windows eventing fits into a broader detection pipeline.
When you are reviewing a potentially risky session, the real question is whether the session ended normally, was interrupted, or disappeared because the host itself changed state. A clean 4634 sequence can still be operationally important, but it is the surrounding pattern, such as failed logons, privilege use, or unusual time-of-day activity, that usually determines whether the event is routine or worth escalation.
Why Audit Logoff Configuration Matters
4634 is only valuable when the host is actually auditing logoff activity. If Audit Logoff is not enabled, you lose visibility into session endings and create blind spots in incident reconstruction, especially when you need to prove whether a user session ended naturally or was cut short by shutdown, remote disconnect, or some other control path. The event is part of the Windows audit trail, not a standalone source of truth.
That is also why this event should be treated as a corroborating signal, not a conclusion on its own. A single 4634 record tells you that the session ended, but it does not by itself explain whether the reason was routine, administrative, or security-relevant. Good investigation practice is to pair it with adjacent authentication, privilege, and process events so you can separate normal session lifecycle from suspicious account use.
If you are hardening the surrounding environment, make sure the account class matches the session type, because service accounts and operator accounts behave differently from end-user accounts. For teams that want a deeper Windows audit reference covering logon, logoff, account changes, and related event IDs, the Windows Event Log Guide is the best adjacent resource in this set.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Windows logoff events are part of audit logging coverage. |
| AU-12 — Audit Generation | 4634 depends on generating the right audit records at the endpoint. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | 4634 is most useful when correlated with adjacent logon and privilege events. | |
| Recommendation — Define logoff auditing so session endings are consistently captured. Enable audit generation for logon and logoff activity. Review 4634 with related events to reconstruct session timelines. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The question depends on logoff auditing and usable event retention. |
| CIS-13 — Network Monitoring and Defense | Session termination events often feed monitoring and detection workflows. | |
| Recommendation — Ensure audit logs retain logon and logoff evidence for investigation. Forward session-ending events into monitoring and alerting pipelines. | ||
Practitioner Guidance
What to verify: Confirm that 4634 is being collected alongside the preceding logon event and that Logon Type, Security ID, and Logon ID are preserved through your forwarding or SIEM pipeline. Without those fields, the event is much harder to use for session reconstruction.
Decision rule: If 4634 is isolated, treat it as a session boundary and look for corroborating evidence before assigning meaning. If it appears alongside privilege use, remote access, or unusual timing, investigate whether the session termination is part of a broader access pattern.
What practitioners underestimate: The difference between user intent and session state. 4634 tells you that the session ended, but it does not prove the user signed out, and that distinction matters when you are investigating abandonment, forced termination, or host shutdown.
Practitioner takeaway: The most reliable way to use 4634 is to treat it as a correlation point, not a verdict, and to interpret it only in the context of the full Windows logon and session sequence.