Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there an Info message in Windows Event viewer that indicates the start of a log off? I'm trying to spot errors and warnings as a user logs off.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

I'm pretty sure that you need to have "Audit logon events" enabled in order to see account logon/logoff events in the Security event log.

In addition, if this is in relation to this question then you can simply look for event 5324 in the GroupPolicy Operational event log, without having to enable account logon auditing.

share|improve this answer

The security log does track login and logoff events, which should give you a timestamp to look for.

  • 4624 -- Logon
  • 4625 -- Failed logon
  • 4634 -- Logoff
  • 4740 -- Account Lockout
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.