Код ошибки 4634

Event Id 4634 event is generated when a logon session is terminated or is destroyed. The session is no longer exists.

When the user initiated the logoff procedure, you will see both Event Id 4647 and 4634.

The main difference between Event Id 4647 vs 4634 is that event id 4647 is generated when a user-initiated the logoff procedure using the logoff function, and event id 4634 is generated when a logon session is terminated and no longer exists.

Event Id 4634 may be positively correlated with Event Id 4624: An account was successfully logged on”. Event using the Login ID value.

Event Id 4634 logon type 2 means user logon to this computer.

In this article, we will discuss event Id 4634, information about event ID 4634, event id 4634 remote desktop (RDP) session terminated, event id 4634 logon types like 2,3,5,7 and 10.

Event ID 4634 Information

Let’s understand event ID 4634 in detail with its fields.

Event Id 4634 XML format

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
 <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{62736363-7623-8273-B5CA-2E3C0352D30E}" /> 
 <EventID>4634</EventID> 
 <Version>0</Version> 
 <Level>0</Level> 
 <Task>14339</Task> 
 <Opcode>0</Opcode> 
 <Keywords>0x8010000000000000</Keywords> 
 <TimeCreated SystemTime="2022-01-22T18:10:21.495462300Z" /> 
 <EventRecordID>16708</EventRecordID> 
 <Correlation /> 
 <Execution ProcessID="520" ThreadID="1084" /> 
 <Channel>Security</Channel> 
 <Computer>DC01.ShellGeek.local</Computer> 
 <Security /> 
 </System>
- <EventData>
 <Data Name="TargetUserName">admin</Data> 
 <Data Name="TargetUserSid">S-1-4-21</Data> 
 <Data Name="TargetDomainName">SHELLGEEK</Data> 
 <Data Name="TargetLogonId">0xd34ccae7</Data> 
 <Data Name="LogonType">2</Data> 
 </EventData>
 </Event>

Cool Tip: How to convert XML to CSV file in the PowerShell!

Fields Description:

Subject Information

• Security Id: Security ID for an account that was logged off.

• Account Name: The name of the account that was logged off.
• Account Domain: Domain name
• Logon ID: It is of HexInt64 type. It contains the hexadecimal value which you can use to correlate event id 4634 with a recent event that may contain the same Logon ID. For example, event Id 4624 – “An account was succssfully logged on.”
• LogonType: It contains value of type UInt32 to represent the type of logon which was used.

Cool Tip: Event Id 4771 – Kerberos pre-authentication failed!

The Logon Type table shows all possible values for this field.

Cool Tip: Event Id 4776 Code 0xc0000234 – Fix to find the source of attempt!

Event Id 4634 logon type 7

When the user unlocks the previously locked workstation, it logs the event id 4634 logon type 7 event.

When the user unlocks the previously locked workstation, it logs the event id 4634 logon type 7 event.

Cool Tip: How to manipulate Active Directory UserAccountControl flags in PowerShell!

Event Id 4634 logon type 3

Event Id 4634 logon type 3 means that the user or computer logged on to this computer from the network.

The user or computer accesses the computer from the network or tries to access shared resources on the computer, it logs the event id 4634 logon type 3 event.

Cool Tip: Event Id 4625 Status Code 0xc000006a – Fix to find the source of attempt!

Conclusion

I hope the above article on Event Id 4634: “An account was logged off” is helpful to you.

Event Id 4634 helps you to monitor the events related to logon attempts, logged off, remote desktop activities from the network.

Cool Tip: Event Id 4670 – Permissions on an object were changed!

Different types of Event Id 4634 logon type like logon type 2, logon type 3, logon type 7, logon type 10 provides detailed description about the event.

This article is using logon types as per the official Microsoft KB article. Refer for more details on these logon types.

You can find more topics about PowerShell Active Directory commands and PowerShell basics on the ShellGeek home page.

You can read more on other windows security and system event logs as given:

• Event Id 4670 – System restart or shutdown
• Event Id 4624 – An account was successfully logged on.

Also see event ID 4647 which Windows logs instead of this event in the case of interactive logons when the user logs out.

This event signals the end of a logon session and can be correlated back to the logon event 4624 using the Logon ID.

For network connections (such as to a file server), it will appear that users log on and off many times a day. This phenomenon is caused by the way the Server service terminates idle connections.

If a user turns off his/her computer, Windows does not have an opportunity to log the logoff event until the system restarts. Therefore, some logoff events are logged much later than the time at which they actually occur.

ANONYMOUS LOGONs are routine events on Windows networks.

Microsoft’s comments:
This event does not necessarily indicate the time that a user has stopped using a system. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all.

Logon Type: indicates how the user was logged on.  See 4624 for explanation of these codes.

Stay up-to-date on the Latest in Cybersecurity

Sign up for the Ultimate IT Security newsletter
to hear about the latest webinars, patches, CVEs, attacks, and more.