5

Here are two common ways users can be logged off of Windows:

  • Manual: The user logs off manually
  • Automated: The windows system logs off the user automatically via some mechanism

Is there any way to determine (based on a stock Windows install, with no special software installed) the method of the logoff? i.e. which of these two methods (Manual/Auto) for logoff were utilized?

1

1 Answer 1

13

When a user invokes a log off/sign out (manual) action, this is logged to the Security event log as Event ID 4647. Automatic log off (session timeout) will be logged to the event log as Event ID 4634.

To review the events in the event log, perform these actions

  1. Load eventvwr from Start > Run
  2. Click on Security under the Windows Logs
  3. Click Filter Current Log on the right-hand actions menu
  4. Enter 4634,4647 in the field under Includes/Excludes Event IDs:

enter image description here

Click OK, and you'll see a list of events related to the chosen event ID's.

If you don't see anything, then either your event log has been purged, or the event is too old and you need to change how much data the event viewer stores.

A comprehensive list of event ID's can be found here.

3
  • Just tried this on my Windows 10 Pro 21H2 which has 3 months of security event log and neither of these events is found. Does your answer only apply to Windows Server ?
    – grahamj42
    Mar 26 at 6:24
  • 1
    My two-day old Win10 21H2 instance has 33 logout events, varied between the two codes (mostly 4634 due to UMFD-X accounts). You're either not logging, not filtering correctly, or not searching the right log. See i.imgur.com/Q7YdFTs.png for a screenshot. Ensure you're filtering the "Windows Logs > Security" log
    – Guy S
    Mar 26 at 11:14
  • @grahamj42 no, my windows 10 laptop on a domain has plenty of events. Mar 26 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.