Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.

share|improve this question
up vote 3 down vote accepted

I'm pretty sure that you need to have "Audit logon events" enabled in order to see account logon/logoff events in the Security event log.

In addition, if this is in relation to this question then you can simply look for event 5324 in the GroupPolicy Operational event log, without having to enable account logon auditing.

share|improve this answer

The security log does track login and logoff events, which should give you a timestamp to look for.

  • 4624 -- Logon
  • 4625 -- Failed logon
  • 4634 -- Logoff
  • 4740 -- Account Lockout
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.