For example, if you see the Event ID 4624 in the Security Log, it indicates the Logon event. Likewise, an Event ID 4647 means user-initiated Logoff, and 4634 is generated when a session no longer exists as it was terminated.