bumgarb42 said:

Hi Brink,
Just a quick typo correction on this one. Step 2 indicates that the user/admin should access the Windows "System" log to filter for Logoff events. The images however show the "Security" log. The images are correct, Logoff events are in the security log. I think Step 2 needs to be corrected to say "Security" instead of "System". Thanks!

Thank you. Now corrected.

Don't we have to enable security auditing before we can see these events?
vistascape post #6 - TenForums
Understating Guide of Windows Security Policies and Event Viewer - HackingArticles

All the best,
Denis

Try3 said:

Don't we have to enable security auditing before we can see these events?
vistascape post #6 - TenForums
Understating Guide of Windows Security Policies and Event Viewer - HackingArticles

All the best,
Denis

Hello Denis,

I didn't have to for these event logs.

Hello @Brink,

I have just put this Script together as an alternative. It outputs ALL the WinEvent ID 4647 entries to the Console, along with the Total number of WinEvent ID 4647 entries . . .

Code:

if not "%1"=="max" start /max cmd /c %0 max & Exit /b
:: ##############################################################################################################
:: # Title     : List ALL 'Logoff' and 'Sign Out' Entries for WinEvent ID 4647                                  #
:: # Created By: Paul Black [ https://www.tenforums.com/members/paul-black.html ]                               #
:: # Created On: 22-Sep-2022                                                                                    #
:: # Tutorial  : https://www.tenforums.com/tutorials/117980-read-logoff-sign-out-logs-event-viewer-windows.html #
:: ##############################################################################################################
Title WinEvent ID
set "Security=Security"
set "WinEvent_ID=4647"
set "Title=WinEvent ID [%WinEvent_ID%]"
set "OUT=%Temp%\OUT.log"
if exist %OUT% (del /f /q %OUT% >nul 2>&1)
echo. & echo Processing . . .
echo. & echo =====================================================================================================================================================================
        echo %Title%:-
        echo =============================================================================== START ===============================================================================& echo.
>> %OUT%     PowerShell "Get-WinEvent -FilterHashtable @{LogName='%Security%'; Id=%WinEvent_ID%} -ErrorAction 'SilentlyContinue' | Format-Table ProviderName, TimeCreated, RecordID, LevelDisplayName, Id, Message -Autosize"
             findstr /rc:"[^ <Tab>]" %OUT% & del %OUT%
echo. & echo =====================================================================================================================================================================
             PowerShell "'Total Entries for WinEvent ID [%WinEvent_ID%]: ' + (Get-WinEvent -FilterHashtable @{LogName='%Security%'; Id=%WinEvent_ID%} -ErrorAction 'SilentlyContinue').Count"
        echo ================================================================================ EOF ================================================================================
echo. & echo Processing Complete.
echo. & echo ^>Press ANY key to EXIT . . . & pause >nul & Exit

I hope that this is useful.

I must have made a mistake before. I've just checked again and I'm seeing EventIDs 4647 after all.

Denis

Brink said:

You are VERY welcome as always.

Hello @Brink,

For anybody wanting to output the results to the Desktop, then use this . . .

Code:

@echo off
:: ##############################################################################################################
:: # Title     : List ALL 'Logoff' and 'Sign Out' Entries for WinEvent ID 4647                                  #
:: # Created By: Paul Black [ https://www.tenforums.com/members/paul-black.html ]                               #
:: # Created On: 22-Sep-2022                                                                                    #
:: # Tutorial  : https://www.tenforums.com/tutorials/117980-read-logoff-sign-out-logs-event-viewer-windows.html #
:: ##############################################################################################################
Title WinEvent ID
for /f "tokens=*" %%a in ('"PowerShell (New-Object -ComObject WScript.Shell).SpecialFolders(4)"') do (set "Desktop=%%a")
if not exist "%Desktop%" (set "Desktop=%Desktop:~1%")
set "Security=Security"
set "WinEvent_ID=4647"
set "Title=WinEvent ID [%WinEvent_ID%]"
set "LOG=WinEvent_ID_%WinEvent_ID%.log"
set "OFN=%Desktop%\%LOG%"
set "OUT=%Temp%\OUT.log"
if exist %OFN% (del /f /q %OFN% >nul 2>&1)
if exist %OUT% (del /f /q %OUT% >nul 2>&1)
echo. & echo  Processing . . .
>> %OFN% echo.
>> %OFN% echo =====================================================================================================================================================================
>> %OFN% echo %Title%:-
>> %OFN% echo =============================================================================== START ===============================================================================& >> %OFN% echo.
>> %OUT%      PowerShell "Get-WinEvent -FilterHashtable @{LogName='%Security%'; Id=%WinEvent_ID%} -ErrorAction 'SilentlyContinue' | Format-Table ProviderName, TimeCreated, RecordID, LevelDisplayName, Id, Message -Autosize | Out-String -Width 1000"
              findstr /rc:"[^ <Tab>]" %OUT% >> %OFN% & del %OUT% & >> %OFN% echo.
>> %OFN% echo =====================================================================================================================================================================
>> %OFN%      PowerShell "'Total Entries for WinEvent ID [%WinEvent_ID%]: ' + (Get-WinEvent -FilterHashtable @{LogName='%Security%'; Id=%WinEvent_ID%} -ErrorAction 'SilentlyContinue').Count"
>> %OFN% echo ================================================================================ EOF ================================================================================
        echo  Processing Complete.
echo. & echo  A [%LOG%] file has been created on the Desktop.
echo. & echo ^>Press ANY key to EXIT . . . & pause >nul & Exit

I hope this is useful.