<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4634</EventID><Version>0</Version><Level>0</Level><Task>12545</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-26T16:49:53.720587500Z'/><EventRecordID>146917848</EventRecordID><Correlation/><Execution ProcessID='784' ThreadID='952'/><Channel>Security</Channel><Computer>IP-C6120045.mgt.oscorpint.com</Computer><Security/></System><EventData><Data Name='TargetUserSid'>S-1-5-18</Data><Data Name='TargetUserName'>charlie</Data><Data Name='TargetDomainName'>mgt</Data><Data Name='TargetLogonId'>0x3ceb984f</Data><Data Name='LogonType'>3</Data></EventData><RenderingInfo Culture='en-US'><Message>An account was logged off.

Subject:
	Security ID:		S-1-5-18
	Account Name:		charlie
	Account Domain:		mgt
	Logon ID:		0x3CEB984F

Logon Type:			3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.</Message><Level>Information</Level><Task>Logoff</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
Product: Windows Logs
Vendor: Microsoft