An account failed to log off

// EVENT DEFINITION:

A user session encountered an error or access denied condition when attempting to terminate.

// DETAILED TELEMETRY & CONTEXT:

Event ID 4635 records logon termination failures, typically when an authentication package cannot release logon session handles or when remote session teardown times out due to locked handles or network interruptions.

[ ! ]Failure Reason / Root Cause Analysis

Authentication package teardown error or handle retention failure during logoff.

Operational Metadata & Applicability

Log Category:Logon/Logoff

Audit Type Classification:Failure Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

4635logoff failuresession termination error

Mitigation Playbook & Recommended SOC Actions

•Check for hanging processes or unclosed network shares retaining active logon session handles (`4658`).

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4635</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.265Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to An account failed to log off -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)