Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 551 - User initiated logoff [Win 2003 / XP]
EventID 551 - User initiated logoff [Win 2003 / XP]
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Logon/Logoff
        Event ID:       538
        Date:           10/26/2009
        Time:           07:31:44
        User:           NT AUTHORITY\SYSTEM
        Computer:       DC1
        Description:
        User Logoff:
        User Name:	DC1$
        Domain:		RESEARCH
        Logon ID:		(0x0,0x60FA64)
        Logon Type:	3
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2003
Windows XP
Source Security
Category Logon/Logoff
EventId 551
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name DC1$
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Logoff" Logoff
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "Low" Low
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment