SOC Event Lookup
Event ID 4634LogonP1

Windows Event ID 4634: An account was logged off

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4634 records termination of a logon session and helps bound the duration of user and service activity.

Technical Metadata

Technical metadata for Event ID 4634
Event ID4634
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0005 Defense Evasion / T1078 Valid Accounts
Key fields to watchSubject, Logon Type, Logon ID

Trigger Scenarios

Windows writes the event when a logon session ends because of user sign-out, shutdown, disconnect, or service termination.

Key Fields

Subject

The account associated with the ending session.

Logon Type

The session type, such as network or RemoteInteractive.

Logon ID

Use this identifier to correlate the event with 4624 and related activity.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4634
SecurityEvent
| where EventID == 4634
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4634
index=wineventlog source="WinEventLog:Security" EventCode=4634
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4634
dataset = microsoft_windows_raw
| filter edr_event_id = 4634
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4634
title: Windows Event ID 4634
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4634
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
LogonType3The ended session was a network logon.Use it to bound network-resource access rather than an interactive desktop session. Source
LogonType10The ended session was RemoteInteractive.Pair it with a Type 10 event 4624 to bound an RDP session timeline. Source

MITRE ATT&CK Mapping

  • T1078Valid Accounts

Detection Notes

For T1078 Valid Accounts timeline reconstruction, pair 4634 with its 4624 by Logon ID. A Type 10 session that has no 4647 user-initiated logoff but ends after suspicious 4688 activity can indicate disconnect or forced session cleanup; the exact Logon Type distinguishes RDP from SMB Type 3 activity.

Common False Positives

  • Normal session completion generates frequent events.
  • Service and network sessions can end rapidly under normal application behavior.

Related Events

Sample Log

Sanitized event sample
Target Account: CORP\jsmith
Logon Type: 10
Logon ID: 0x1a2b3c

Frequently Asked Questions

What does Windows Event ID 4634 mean?

Event ID 4634 records that a Windows logon session was terminated and identifies the session through its Logon ID and Logon Type.

How do analysts pair 4634 with a logon?

Match the 4634 Logon ID to the Logon ID in event 4624 on the same computer; the identifier is only unique between reboots on that computer.

Is 4634 a user-initiated logoff?

Not necessarily. Event 4647 specifically records a user-initiated logoff, while 4634 records session termination and can also result from other cleanup paths.

Sources