Windows Event ID 6279 – WinLogon: User Logon Session Destroyed

Start by examining the specific details of Event ID 6279 to understand the session termination context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 6279 by right-clicking the Security log and selecting Filter Current Log
4. Enter 6279 in the Event IDs field and click OK
5. Double-click on recent Event ID 6279 entries to examine details including:
   • Subject Security ID and Account Name
   • Logon ID (correlates with logon events)
   • Session Name and Logon Type
   • Source Network Address (for remote sessions)
6. Use PowerShell to query multiple events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=6279} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='LogonID';Expression={$_.Properties[3].Value}}

Use PowerShell to analyze session patterns and identify potential issues with session management.

1. Create a comprehensive session analysis script:

# Get session destruction events from the last 24 hours
$StartTime = (Get-Date).AddDays(-1)
$SessionEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=6279
    StartTime=$StartTime
} | ForEach-Object {
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        UserName = $_.Properties[1].Value
        LogonID = $_.Properties[3].Value
        SessionName = $_.Properties[4].Value
        LogonType = $_.Properties[5].Value
        SourceIP = $_.Properties[6].Value
    }
}

# Group by user to identify patterns
$SessionEvents | Group-Object UserName | Sort-Object Count -Descending

2. Analyze session duration by correlating with logon events:

# Find matching logon/logoff pairs
$LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$StartTime}
$SessionDurations = foreach ($Logoff in $SessionEvents) {
    $MatchingLogon = $LogonEvents | Where-Object {
        $_.Properties[7].Value -eq $Logoff.LogonID
    } | Select-Object -First 1
    
    if ($MatchingLogon) {
        [PSCustomObject]@{
            User = $Logoff.UserName
            LogonTime = $MatchingLogon.TimeCreated
            LogoffTime = $Logoff.TimeCreated
            Duration = $Logoff.TimeCreated - $MatchingLogon.TimeCreated
        }
    }
}

$SessionDurations | Sort-Object Duration -Descending

Ensure proper audit policy configuration to capture comprehensive session information.

1. Check current audit policy settings using Group Policy or command line:

# Check current audit policy
auditpol /get /category:"Logon/Logoff"

# Enable detailed logon auditing if needed
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Logoff" /success:enable /failure:enable

2. Configure Group Policy for enterprise environments:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Audit Policies → Logon/Logoff
   • Enable Audit Logon and Audit Logoff for both Success and Failure
3. Verify audit policy application:

# Check effective audit policy
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name MaxSize

# Monitor audit policy changes
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719} -MaxEvents 10

4. Configure Security log retention settings in registry:

# Increase Security log size (value in bytes)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "MaxSize" -Value 104857600

# Set retention policy (0=overwrite as needed, 1=overwrite events older than X days)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name "Retention" -Value 0

Set up proactive monitoring for unusual session termination patterns that might indicate security issues.

1. Create a PowerShell script for continuous session monitoring:

# Session monitoring script
param(
    [int]$ThresholdMinutes = 60,
    [string]$LogPath = "C:\Logs\SessionMonitoring.log"
)

$StartTime = (Get-Date).AddMinutes(-$ThresholdMinutes)
$SuspiciousEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=6279
    StartTime=$StartTime
} | Where-Object {
    # Flag sessions terminated within 5 minutes of logon
    $LogonEvents = Get-WinEvent -FilterHashtable @{
        LogName='Security'
        Id=4624
        StartTime=$StartTime
    } | Where-Object {$_.Properties[7].Value -eq $_.Properties[3].Value}
    
    if ($LogonEvents) {
        $Duration = $_.TimeCreated - $LogonEvents[0].TimeCreated
        $Duration.TotalMinutes -lt 5
    }
}

if ($SuspiciousEvents) {
    $Alert = "ALERT: {0} suspicious session terminations detected" -f $SuspiciousEvents.Count
    Add-Content -Path $LogPath -Value "$(Get-Date): $Alert"
    # Send email or trigger SIEM alert here
}

2. Schedule the monitoring script using Task Scheduler:

# Create scheduled task for session monitoring
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\SessionMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount

Register-ScheduledTask -TaskName "SessionMonitoring" -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal

3. Configure Windows Event Forwarding for centralized monitoring:

# Enable WinRM for event forwarding
winrm quickconfig -force

# Configure event subscription (run on collector server)
wecutil cs SessionDestructionSubscription.xml

# Example subscription XML content:
# <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
#   <SubscriptionId>SessionDestruction</SubscriptionId>
#   <Query><![CDATA[<QueryList><Query><Select Path="Security">*[System[EventID=6279]]</Select></Query></QueryList>]]></Query>
# </Subscription>

Perform deep forensic analysis when Event ID 6279 patterns indicate potential security incidents or system issues.

1. Create comprehensive forensic analysis queries:

# Advanced forensic analysis script
$AnalysisStart = (Get-Date).AddDays(-7)

# Get all session events with detailed context
$SessionData = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=@(4624,4634,4647,6279)
    StartTime=$AnalysisStart
} | ForEach-Object {
    $EventData = @{}
    for ($i = 0; $i -lt $_.Properties.Count; $i++) {
        $EventData["Property$i"] = $_.Properties[$i].Value
    }
    
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        EventID = $_.Id
        UserName = $EventData.Property1
        LogonID = $EventData.Property3
        LogonType = $EventData.Property8
        SourceIP = $EventData.Property11
        ProcessName = $EventData.Property9
        AllProperties = $EventData
    }
}

# Identify anomalous patterns
$AnomalousPatterns = $SessionData | Group-Object UserName | Where-Object {
    $_.Count -gt 100 -or  # High session count
    ($_.Group | Group-Object SourceIP | Measure-Object).Count -gt 10  # Multiple source IPs
}

2. Analyze session termination reasons and correlate with system events:

# Correlate with system events that might cause session termination
$SystemEvents = Get-WinEvent -FilterHashtable @{
    LogName='System'
    Id=@(1074,6005,6006,6008,6009)
    StartTime=$AnalysisStart
}

# Find sessions terminated near system events
$CorrelatedEvents = foreach ($SysEvent in $SystemEvents) {
    $NearbySessionEvents = $SessionData | Where-Object {
        $_.EventID -eq 6279 -and
        [Math]::Abs(($_.TimeCreated - $SysEvent.TimeCreated).TotalMinutes) -lt 5
    }
    
    if ($NearbySessionEvents) {
        [PSCustomObject]@{
            SystemEvent = $SysEvent.Id
            SystemTime = $SysEvent.TimeCreated
            AffectedSessions = $NearbySessionEvents.Count
            Users = ($NearbySessionEvents.UserName | Sort-Object -Unique) -join ', '
        }
    }
}

3. Generate detailed forensic reports:

# Generate comprehensive session report
$Report = @{
    TotalSessions = ($SessionData | Where-Object EventID -eq 6279).Count
    UniqueUsers = ($SessionData.UserName | Sort-Object -Unique).Count
    TopUsers = $SessionData | Group-Object UserName | Sort-Object Count -Descending | Select-Object -First 10
    SessionsByHour = $SessionData | Group-Object {$_.TimeCreated.Hour} | Sort-Object Name
    RemoteSessions = $SessionData | Where-Object {$_.SourceIP -and $_.SourceIP -ne '-'}
    AnomalousPatterns = $AnomalousPatterns
    SystemCorrelations = $CorrelatedEvents
}

# Export to JSON for further analysis
$Report | ConvertTo-Json -Depth 3 | Out-File "C:\Forensics\SessionAnalysis_$(Get-Date -Format 'yyyyMMdd_HHmmss').json"