#session-management

Windows Event ID 6279 – WinLogon: User Logon Session Destroyed

Event ID 6279 indicates that a user logon session has been destroyed in Windows. This informational event fires when a user logs off, disconnects from a remote session, or when the system terminates a session due to timeout or policy enforcement.

Windows Event ID 6145 – WinLogon: User Logon Session Destroyed

Event ID 6145 indicates a user logon session has been destroyed by the Windows Logon service, typically occurring during normal logoff, system shutdown, or forced session termination.

Windows Event ID 4778 – Microsoft-Windows-Security-Auditing: Session Reconnected to a Window Station

Event ID 4778 logs when a user session reconnects to a Windows workstation or server, typically after Remote Desktop disconnection or console switching. Critical for tracking user activity and session management.

Windows Event ID 1125 – User32: User Logon Session Notification

Event ID 1125 from User32 indicates a user logon session notification event, typically fired during interactive logon processes or session state changes in Windows environments.

Windows Event ID 5617 – Winlogon: User Logon Session Destroyed

Event ID 5617 indicates that a user logon session has been destroyed by the Windows Logon service, typically occurring during normal user logoff or session termination processes.

Windows Event ID 1532 – User32: Desktop Window Manager Session Ended

Event ID 1532 from User32 indicates the Desktop Window Manager (DWM) session has ended, typically during user logoff, system shutdown, or when switching between user sessions.