From 1fc8e3c92d1ebc8cbe2262e0bf5da819871a9f5b Mon Sep 17 00:00:00 2001 From: zTemplar85 Date: Mon, 20 Nov 2017 14:17:08 +0800 Subject: [PATCH] Referencing wrong event id Believe it should read 4634 instead of 4647 --- windows/device-security/auditing/event-4634.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/auditing/event-4634.md b/windows/device-security/auditing/event-4634.md index ed2fc54241..a6b32d39a0 100644 --- a/windows/device-security/auditing/event-4634.md +++ b/windows/device-security/auditing/event-4634.md @@ -23,7 +23,7 @@ author: Mir0sh This event shows that logon session was terminated and no longer exists. -The main difference between “[4647](event-4647.md): User initiated logoff.” and 4647 event is that 4647 event is generated when logoff procedure was initiated by specific account using logoff function, and 4634 event shows that session was terminated and no longer exists. +The main difference between “[4647](event-4647.md): User initiated logoff.” and 4634 event is that 4647 event is generated when logoff procedure was initiated by specific account using logoff function, and 4634 event shows that session was terminated and no longer exists. 4647 is more typical for **Interactive** and **RemoteInteractive** logon types when user was logged off using standard methods. You will typically see both 4647 and 4634 events when logoff procedure was initiated by user.