Windows logon event frequency RRS feed

  • Question

  • How frequently the events 4624 and 4634 come to a domain controller? As 4634 is not the actual logoff event, so can I assume that a user has been logged off if domain controller doesn't get a pair of 4624/4634 from a workstation (specified by the ip address in the event)
    Friday, September 16, 2016 10:53 AM