What log messages do I need to look for that indicate the start of a log-off in Windows Event Viewer?

Question

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.

Answer 1

I'm pretty sure that you need to have "Audit logon events" enabled in order to see account logon/logoff events in the Security event log.

In addition, if this is in relation to this question then you can simply look for event 5324 in the GroupPolicy Operational event log, without having to enable account logon auditing.

Answer 2

The security log does track login and logoff events, which should give you a timestamp to look for.

• 4624 -- Logon
• 4625 -- Failed logon
• 4634 -- Logoff
• 4740 -- Account Lockout