RDP Event ID 23: Session logoff
Remote Desktop Services: Session logoff succeededRDP event 23 is logged when a Remote Desktop or console session is logged off, closing the session opened by event 21.
23
- Event ID
- 23
- Channel
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Provider
- Microsoft-Windows-TerminalServices-LocalSessionManager
- Log file
- Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
- Category
- Remote access
- Default logging
- Logged by default
What event 23 means
Event 23 marks the end of a session: the user signed out, or the session was logged off by an administrator or a policy. It carries the user and session ID but no source address.
Together with 21 it bounds the lifetime of a session. Sessions that were only disconnected (24) stay alive and end with 23 later — sometimes much later, when a disconnected-session time limit applies.
When it is logged
Audit policy / configuration
None — the LocalSessionManager/Operational channel is enabled by default.
Key fields
| Field | What it tells you |
|---|---|
| User | Account whose session was logged off. |
| SessionID | Session number, matching the 21 that opened it. |
Common benign sources
- Users signing out; session time limits logging off idle or disconnected sessions.
What attackers do that produces it
- An intruder logging off to close the session; the time bounds their hands-on activity.
Investigation tips
- Match SessionID with 21 and 24/25 to reconstruct the full session timeline.
- Security 4647 and 4634 for the same user should appear at about the same time.
MITRE ATT&CK techniques
| Technique | Tactics |
|---|---|
| T1021.001 Remote Services: Remote Desktop Protocol | Lateral Movement |
MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.
Sigma rules for this event
No bundled SigmaHQ rule targets this event ID specifically. Rules on related events may still cover the activity.
Run these rules on your logs
Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.