Event ID 4634 — Closing of,one session

A Windows session has been closed

TopicIT resources → About 1 min read

A Windows session has been closed.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

Normal Logout
End of one service session
End of network connection

Verifications to be carried out

Correlate Logon ID with the corresponding event 4624
Check the duration of the session if necessary

Commands

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634} -MaxEvents 20

Key takeaways

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.