Our Windows 2012 R2 domain controller records a Log off Event 4634 (type 3) in Event Viewer almost immediately after a user has logged on. The Event Log states the user has successfully logged off.
However, the user remains connected and can access network resources.
Is this usual behavior and what could be causing it?
Many thanks in advance