User initiated logoff:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1
This event is generated when a logoff is initiated but the token reference count is not zero and the logon session cannot be destroyed. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
This event is usually followed by a 4634 event in case of console logons.
This event can be correlated back to a logon event (4624) using the value of the "Logon ID".