Event ID:
4634
Source:
Microsoft-Windows-Security-Auditing
Category:
Logoff
Message:
An account was logged off.
Subject:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1
Logon Type: 2
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Subject:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1
Logon Type: 2
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Solution by Event Log Doctor
Wed Jun 10 14:51:56 -0400 2009This event is logged when a user logs off, and can be correlated back to the logon event (4624) with the "Logon ID" value.
The logon type indicates the type of session that was logged off, e.g. Interactive (2), Terminal Services or other.
This event might not be logged if a user shuts down a Vista (or higher) computer without logging off.