Event ID 4634 and 4647: an account was logged off
Every logon (4624) ends with a logoff. Windows writes two kinds: 4647 when a user signs out themselves, and 4634 when the logon session is actually gone. Together with the Logon ID they tell you how long someone was on a Server – useful when you reconstruct what happened in a Remote Desktop session.
- 4647: the user started the logoff (Sign out). Only for interactive and Remote Desktop sessions.
- 4634: the logon session ended. For every logon type, often seconds after a network logon.
- The link: the Logon ID is the same in the logon (4624) and the logoff.
- Missing logoff? Normal after a crash, a power cut or a disconnected (not signed-out) Remote Desktop session.
1. The two events
| Event | When | Notes |
|---|---|---|
| 4647 | User initiated logoff | Sign out from the Start menu, logoff, shutdown /l. Written at the start of the logoff. |
| 4634 | An account was logged off | The logon session no longer exists. For network logons (type 3) it follows within seconds – a file share access is a logon and a logoff. |
Both come from the audit subcategory Logoff, which Windows enables by default. A disconnected Remote Desktop session (window closed, not signed out) is still logged on: no logoff until someone signs out or the session limit ends it.
2. PowerShell: how long were the Remote Desktop sessions?
As administrator; logons and logoffs are matched by TargetLogonId:
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$start = (Get-Date).AddDays(-7)
$on = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$start} -ErrorAction SilentlyContinue |
ForEach-Object { $f = Get-EventFields $_; if ($f.LogonType -eq '10') { [pscustomobject]@{ Id = $f.TargetLogonId; User = $f.TargetUserName; From = $f.IpAddress; On = $_.TimeCreated } } }
$off = @{}; Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4634,4647; StartTime=$start} -ErrorAction SilentlyContinue |
ForEach-Object { $f = Get-EventFields $_; if (-not $off[$f.TargetLogonId]) { $off[$f.TargetLogonId] = $_.TimeCreated } }
$on | ForEach-Object { $end = $off[$_.Id]
[pscustomobject]@{ User = $_.User; From = $_.From; LoggedOn = $_.On; LoggedOff = $end; Minutes = if ($end) { [int]($end - $_.On).TotalMinutes } else { 'still on / no logoff' } } } |
Format-Table -AutoSize3. Reading it
- A long session at night from an address you do not know is worth a look – check what was done in it (new accounts: 4720, new services: 7045, scheduled tasks: 4698).
- Many short type 3 logon / logoff pairs from one computer are normal: file shares, printers, management tools.
- No logoff at all for a Remote Desktop logon: the session is still there (
query session) or the computer did not shut down cleanly.
4. Let Coinetic watch it for you
Coinetic works where most of these logons start – on the way in:
- Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
- Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
- Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Why do I see 4634 without 4647?
4647 exists only when a user signs out themselves from an interactive or Remote Desktop session. Network logons, services and sessions that were ended by Windows only get a 4634.
Why is there a 4634 seconds after the logon?
That is a network logon (type 3): opening a file share or a printer logs on, does the work and logs off again right away.
Does closing the Remote Desktop window log me off?
No. It disconnects the session, which keeps running with your programs. Only Sign out logs off (4647, then 4634).