Skip to content

Event ID 23: Remote Desktop Services: Session logoff succeeded:

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Remote Desktop Services: Session logoff succeeded:

Event 23
TerminalServices-LocalSessionManager
TerminalServices-LocalSessionManager/Operational log
Information

A Remote Desktop session logged off.

Related: 21, 24

Message and fields (as Event Viewer shows them) 
Remote Desktop Services: Session logoff succeeded:

User: …
Session ID: …

The event logging service encountered an error (res=…) while initializing logging resources for channel

Event 23
Eventlog
Security / System log
Error
Message and fields (as Event Viewer shows them) 
The event logging service encountered an error (res=…) while initializing logging resources for channel ….

The Windows key was pressed during boot.

Event 23
Kernel-Boot
System log
Information
Message and fields (as Event Viewer shows them) 
The Windows key was pressed during boot.

Uninstallation Successful: Windows successfully uninstalled the following update

Event 23
WindowsUpdateClient
System log
Information
Message and fields (as Event Viewer shows them) 
Uninstallation Successful: Windows successfully uninstalled the following update: …

The time provider NtpServer encountered an error while digitally signing the NTP response for symmetric peer

Event 23
Time-Service
System log
Warning
Message and fields (as Event Viewer shows them) 
The time provider NtpServer encountered an error while digitally signing the NTP response for symmetric peer …. NtpServer cannot provide secure (signed) time to the peer and will not send a packet. The error was: …

Final PORT_CONFIGURATION_INFORMATION data

Event 23
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Final PORT_CONFIGURATION_INFORMATION data

CorrelationId = …; GroupOperationId = …; OperationId = …; Commandline= …; CreatedProcessId = …; ClientMachine = …; User = …; ClientProcessId

Event 23
WMI-Activity
WMI-Activity/Operational log
Information
Message and fields (as Event Viewer shows them) 
CorrelationId = …; GroupOperationId = …; OperationId = …; Commandline= …; CreatedProcessId = …; ClientMachine = …; User = …; ClientProcessId = …

An application cleared the peer list.

Event 23
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them) 
An application cleared the peer list.