6

Here are two common ways users can be logged off of Windows:

  • Manual: The user logs off manually
  • Automated: The windows system logs off the user automatically via some mechanism

Is there any way to determine (based on a stock Windows install, with no special software installed) the method of the logoff? i.e. which of these two methods (Manual/Auto) for logoff were utilized?

Improve this question
1

1 Answer 1

Reset to default
14

When a user invokes a log off/sign out (manual) action, this is logged to the Security event log as Event ID 4647. Automatic log off (session timeout) will be logged to the event log as Event ID 4634.

To review the events in the event log, perform these actions

  1. Load eventvwr from Start > Run
  2. Click on Security under the Windows Logs
  3. Click Filter Current Log on the right-hand actions menu
  4. Enter 4634,4647 in the field under Includes/Excludes Event IDs:

enter image description here

Click OK, and you'll see a list of events related to the chosen event ID's.

If you don't see anything, then either your event log has been purged, or the event is too old and you need to change how much data the event viewer stores.

A comprehensive list of event ID's can be found here.

Improve this answer
3
  • Just tried this on my Windows 10 Pro 21H2 which has 3 months of security event log and neither of these events is found. Does your answer only apply to Windows Server ?
    – grahamj42
    Commented Mar 26, 2022 at 6:24
  • 1
    My two-day old Win10 21H2 instance has 33 logout events, varied between the two codes (mostly 4634 due to UMFD-X accounts). You're either not logging, not filtering correctly, or not searching the right log. See i.imgur.com/Q7YdFTs.png for a screenshot. Ensure you're filtering the "Windows Logs > Security" log
    – Guy S
    Commented Mar 26, 2022 at 11:14
  • @grahamj42 no, my windows 10 laptop on a domain has plenty of events.
    – spikey_richie
    Commented Mar 26, 2022 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .