Logon Type: indicates how the user was logged on. For example, if the computer is shut down or loses network connectivity it may not record a logoff event at all. This event does not necessarily indicate the time that a user has stopped using a system. Therefore, some logoff events are logged much later than the time at which they actually occur.ĪNONYMOUS LOGONs are routine events on Windows networks.
If a user turns off his/her computer, Windows does not have an opportunity to log the logoff event until the system restarts. This phenomenon is caused by the way the Server service terminates idle connections. This event signals the end of a logon session and can be correlated back to the logon event 4624 using the Logon ID.įor network connections (such as to a file server), it will appear that users log on and off many times a day. Also see event ID 4647 which Windows logs instead of this event in the case of interactive logons when the user logs out.
0 kommentar(er)
