#event-id-6279

1 article

Windows Events1

Windows security monitoring dashboard displaying session management events in a professional SOC environment

Event 6279

WinLogon

Windows EventInformation

Windows Event ID 6279 – WinLogon: User Logon Session Destroyed

Event ID 6279 indicates that a user logon session has been destroyed in Windows. This informational event fires when a user logs off, disconnects from a remote session, or when the system terminates a session due to timeout or policy enforcement.

March 1812 min