Event ID 4634 — Closing of,one session

A Windows session has been closed.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Normal Logout
• End of one service session
• End of network connection

Verifications to be carried out

1. Correlate Logon ID with the corresponding event 4624
2. Check the duration of the session if necessary

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.