What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Question

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.

score 4 · Answer 1 · answered Sep 30 '12 at 17:16

4

The security log does track login and logoff events, which should give you a timestamp to look for.

4624 -- Logon
4625 -- Failed logon
4634 -- Logoff
4740 -- Account Lockout

answered Sep 30 '12 at 17:16

sysadmin1138

131,083
18
173
296

score 3 · Accepted Answer · edited Apr 13 '17 at 12:14

3

I'm pretty sure that you need to have "Audit logon events" enabled in order to see account logon/logoff events in the Security event log.

In addition, if this is in relation to this question then you can simply look for event 5324 in the GroupPolicy Operational event log, without having to enable account logon auditing.

edited Apr 13 '17 at 12:14

Community

1

answered Sep 30 '12 at 17:44

joeqwerty

108,377
6
80
171

What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

2 Answers2