An account was logged off

What it means

A logon session ended. Match the Logon ID with 4624 to measure session length.

Why it matters

Mostly useful for investigations: how long was an account connected?

What to do

• Correlate Logon ID with the matching 4624.
• Expect high volume; don’t alert on it alone.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'Security'; Id = 4634
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.