Event ID 4634Audit SuccessSecurity
Windows Event ID 4634 — Account Logoff
Logged when an account's logon session ends. Paired with 4624 it lets you reconstruct the full duration of a session.
Why It Matters
On its own, 4634 is low-value. Combined with 4624, it lets you calculate session duration — useful for spotting abnormally long interactive sessions or overnight access that shouldn't exist.
Key Fields
Logon IDLinks back to the matching 4624 event for this session
Logon TypeSame types as 4624 — helps identify which type of session ended
Account NameThe account whose session ended
Investigation Tips
- 1.Join 4624 and 4634 on Logon ID to get session start and end times.
- 2.Note that network (Type 3) logoffs are often not reliably logged — missing 4634s for network logons are normal.
- 3.Long gaps between 4624 and 4634 on an admin account late at night warrant investigation.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 4634 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →