Submit a ticketCall us

WebinarUpcoming Webinar: How Help Desk and Remote Support Pays for Itself

Learn how help desk software can simplify ticketing management, allow you to track hardware and software assets, and accelerate the speed of IT support and service delivery. Gain insights on how remote support tools allow your IT team to maximize their efficiency and ticket resolution by expediting desktop troubleshooting, ultimately helping keep end-users happy and productive.

Register here.

Home > Success Center > Log & Event Manager (LEM) > Windows Event ID 4634 displays in the LEM Console

Windows Event ID 4634 displays in the LEM Console

Table of contents

Updated: September 28, 2017


Event ID 4634 displays in the SolarWinds LEM console. 


  • LEM
  • Windows Agent with security Event log enabled


Normalized log data for Windows Event ID 4634 displays in the LEM Console, as shown below. 

As displayed above, the following fields are missing data:

  • Destination Account
  • Source Machine
  • Destination Machine

This data may not be applicable for a UserLogOff event. As a result, Microsoft® omitted this data in the Security Event log file. 

See 4634(S): An account was logged off on the Microsoft Docs website for details. 



Last modified