#user32-events

Windows Event ID 1125 – User32: User Logon Session Notification

Event ID 1125 from User32 indicates a user logon session notification event, typically fired during interactive logon processes or session state changes in Windows environments.

Windows Event ID 1531 – User32: Desktop Window Manager Session Ended

Event ID 1531 from User32 indicates the Desktop Window Manager (DWM) session has terminated, typically during user logoff, system shutdown, or when DWM crashes unexpectedly.