Event ID 4634: An account was logged off
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.
An account was logged off.
A logon session ended. Network logons (type 3) end within seconds, so these come in large numbers and are rarely interesting on their own.
Logon types
| 2 | Interactive | At the keyboard (or a KVM / console session). |
|---|---|---|
| 3 | Network | Access over the network: file shares, IIS with Windows authentication, most remote management. |
| 4 | Batch | A scheduled task or batch job. |
| 5 | Service | A service started under this account. |
| 7 | Unlock | The workstation was unlocked. |
| 8 | NetworkCleartext | Network logon with the password sent in clear text (IIS basic authentication, some scripts). Worth eliminating. |
| 9 | NewCredentials | runas /netonly: the local identity stays, other credentials are used for network access. |
| 10 | RemoteInteractive | Remote Desktop (Terminal Services) logon. |
| 11 | CachedInteractive | Logon with cached domain credentials, without reaching a domain controller (laptops off the network). |
| 12 | CachedRemoteInteractive | Remote Desktop logon with cached credentials. |
| 13 | CachedUnlock | Unlock with cached credentials. |