Windows Security Log · Event 4634
Event 4634: An account was logged off
A sign-in session ended. It is the bookend to Event 4624 and is mostly useful for measuring how long a session lasted. On its own it tells you almost nothing, and it fires constantly.
Also written as 4634Event ID 4634An account was logged off
- How oftenFires constantly
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
On a personal computer
Nothing to worry about. Windows opens and closes sign-in sessions constantly for its own background work, so these pile up even when you have not touched the machine.
For an analyst
Do not treat 4634 as a user logging off — most are network sessions closing. For an actual user-initiated sign-out, 4647 is the more reliable event. Join on Logon ID to bound a session.
The fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account whose session ended.
- TargetLogonId
- The session identifier. Match it against the same value in a 4624 to find when the session started.
- LogonType
- The type of session that closed, using the same values as 4624. Type 3 network sessions dominate the volume.
Ordinary reasons this happens
Most of the time it is one of these.
- Any network session closing after a file share or printer access completes — the bulk of the volume.
- A user signing out or the machine restarting.
- A scheduled task or service finishing its work.
- Remote Desktop sessions disconnecting or timing out.
What to do next
- Take the Logon ID and find the matching 4624 to establish when the session began.
- Compare the two timestamps. A very long interactive or Remote Desktop session is more interesting than the logoff itself.
- If you are looking for a deliberate sign-out rather than a session teardown, use 4647 instead.
Common questions
Does Event 4634 mean a user logged off?
Not usually. Most 4634 entries close short network sessions that Windows opened for file sharing or authenticated remote calls, not anything a person did. For a genuine user sign-out, look for Event 4647 instead.
How do I match Event 4634 to the login that started the session?
Use the Logon ID. It is unique per session and appears in both the 4624 that opened it and the 4634 that closed it, so searching the Security log for that value gives you both ends and everything stamped with it in between.
Why are there so many 4634 events when nobody is using the computer?
Windows authenticates in the background constantly — services starting, the computer account talking to the domain, other machines reaching shared resources. Each of those opens and closes a session, and each closure writes a 4634.
Read next
- Usually comes before Event 4624: An account was successfully logged on The sign-in that opened this session. Join on Logon ID.
- The equivalent of Event 4647: A user initiated the logoff Recorded when a user deliberately signs out, which 4634 does not reliably indicate.
- Related Event 4625: An account failed to log on The failure case, where no session is created at all.
Vendor documentation
Last reviewed 28 August 2026