Windows Event ID 4634: An account was logged off
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4634 records termination of a logon session and helps bound the duration of user and service activity.
Technical Metadata
| Event ID | 4634 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0005 Defense Evasion / T1078 Valid Accounts |
| Key fields to watch | Subject, Logon Type, Logon ID |
Trigger Scenarios
Windows writes the event when a logon session ends because of user sign-out, shutdown, disconnect, or service termination.
Key Fields
Subject
The account associated with the ending session.
Logon Type
The session type, such as network or RemoteInteractive.
Logon ID
Use this identifier to correlate the event with 4624 and related activity.
Threat Hunting Queries
SecurityEvent
| where EventID == 4634
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4634
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4634- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
title: Windows Event ID 4634
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4634
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| LogonType | 3 | The ended session was a network logon. | Use it to bound network-resource access rather than an interactive desktop session. Source |
| LogonType | 10 | The ended session was RemoteInteractive. | Pair it with a Type 10 event 4624 to bound an RDP session timeline. Source |
MITRE ATT&CK Mapping
- T1078Valid Accounts
Detection Notes
For T1078 Valid Accounts timeline reconstruction, pair 4634 with its 4624 by Logon ID. A Type 10 session that has no 4647 user-initiated logoff but ends after suspicious 4688 activity can indicate disconnect or forced session cleanup; the exact Logon Type distinguishes RDP from SMB Type 3 activity.
Common False Positives
- Normal session completion generates frequent events.
- Service and network sessions can end rapidly under normal application behavior.
Related Events
Sample Log
Target Account: CORP\jsmith
Logon Type: 10
Logon ID: 0x1a2b3cFrequently Asked Questions
What does Windows Event ID 4634 mean?
Event ID 4634 records that a Windows logon session was terminated and identifies the session through its Logon ID and Logon Type.
How do analysts pair 4634 with a logon?
Match the 4634 Logon ID to the Logon ID in event 4624 on the same computer; the identifier is only unique between reboots on that computer.
Is 4634 a user-initiated logoff?
Not necessarily. Event 4647 specifically records a user-initiated logoff, while 4634 records session termination and can also result from other cleanup paths.
Sources
- 4634: Microsoft Windows security auditing event reference
Microsoft · vendor
- Valid Accounts (T1078)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule