Windows Task scheduler Winlogon events - logout not enough(?)

Question

I created a powershell script that I want to run on every logout / restart / shut down.

For trigger I set a custom event: Log: System, Source: Winlogon, Event ID: 7002. I found the above event id somewhere on the internet - it stands for log out (AFAIK).

The problem is that it works only when I go and press Log Out. It doesn't when I want to Shut down or Restart the PC.

Should it even work? And if not, where can I find the other event ID's? How do I even look for them? (I mean what is their name?)

Solution 1

You should add event IDs:

• 6005
• 6006
• 1074
• 4634
• 4647

These reflect a variety of log on/off scenarios and shutdowns.

Reference:

• Description of the Shutdown Event Tracker
• Audit Logoff

Solution 2

Instead of telling you what events I guess might happen, here is how to discover the events yourself:

You can check the events that have happened on your device by checking your Event Viewer through Control Panel. It will show you their names and event ID numbers.

The logon/logoff events show up under the folder called "Windows Events" on the log called "Security".

If there are any events you are not catching, you will now be able to know what they are!

Comments

[and31415]

What is the script supposed to do?

[Martin Fejes]

It deletes files.

[Qwilson]

support.microsoft.com/kb/293814 and technet.microsoft.com/en-us/library/dd941621(v=ws.10).aspx ... I'm editing my post to reflect this information.

[Martin Fejes]

I see. So simply the logout event was not enough. Can you please tell me where I can find a list of these events and their ID's?

[Qwilson]

Unfortunately, I don't know of a definitive list of of all the related on/off id's, but if you search eventid.net you will find a wealth of information regarding all kinds of events.