Windows Task scheduler Winlogon events - logout not enough(?)

Question

I created a powershell script that I want to run on every logout / restart / shut down.

For trigger I set a custom event: Log: System, Source: Winlogon, Event ID: 7002. I found the above event id somewhere on the internet - it stands for log out (AFAIK).

The problem is that it works only when I go and press Log Out. It doesn't when I want to Shut down or Restart the PC.

Should it even work? And if not, where can I find the other event ID's? How do I even look for them? (I mean what is their name?)

Answer 1

You should add event IDs:

• 6005
• 6006
• 1074
• 4634
• 4647

These reflect a variety of log on/off scenarios and shutdowns.

Reference:

• Description of the Shutdown Event Tracker
• Audit Logoff

Answer 2

Instead of telling you what events I guess might happen, here is how to discover the events yourself:

You can check the events that have happened on your device by checking your Event Viewer through Control Panel. It will show you their names and event ID numbers.

The logon/logoff events show up under the folder called "Windows Events" on the log called "Security".

If there are any events you are not catching, you will now be able to know what they are!