Submit a ticketCall us

whitepaperYour VM Perplexities Called, and They Need You to Read This.

Virtualization can give you enormous flexibility with future workloads and can be a key enabler for other areas, like cloud computing and disaster recovery. So, how can you get a handle on the performance challenges in your virtual environment and manage deployments without erasing the potential upside? Learn the four key areas you need to be focusing on to help deliver a healthy and well-performing data center.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Windows Event ID 4634 displays in the LEM Console

Windows Event ID 4634 displays in the LEM Console

Table of contents

Updated: September 28, 2017


Event ID 4634 displays in the SolarWinds LEM console. 


  • LEM
  • Windows Agent with security Event log enabled


Normalized log data for Windows Event ID 4634 displays in the LEM Console, as shown below. 

As displayed above, the following fields are missing data:

  • Destination Account
  • Source Machine
  • Destination Machine

This data may not be applicable for a UserLogOff event. As a result, Microsoft® omitted this data in the Security Event log file. 

See 4634(S): An account was logged off on the Microsoft Docs website for details. 



Last modified