Windows EventInformation
Windows Event ID 6145 – WinLogon: User Logon Session Destroyed
Event ID 6145 indicates a user logon session has been destroyed by the Windows Logon service, typically occurring during normal logoff, system shutdown, or forced session termination.
