Skip to main content
AD Academy
Back to all events
4634SecurityAuthenticationINFOLast updated:

Logoff

What it means

A session ended. Mostly used to measure session length together with 4624 — not every 4624 gets a matching 4634.

First steps

  1. 1Match 4624 to 4634 by Logon ID, not by user name.
  2. 2An RDP session open for weeks with no 4634 is worth a look.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.