The Windows Process Journey — “logoff.exe” (Session Logoff Utility)

“logoff.exe” (Session Logoff Utility) is a command line tool that allows logging off a user from a session. The session could be the current session in which the command is executed, a specific session identified by a number or a remote session on a different server (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/logoff). The executable file is located at “%windir%\System32\logoff.exe”.

Moreover, an administrator can set a script/executable to be executed when the user is logging off. This setting can be configured using a local policy/group policy and is called “Logoff script). Alos, this configuration is part of the “User Configuration -> Windows Settings -> Scripts” — as shown in the screenshot below (https://social.technet.microsoft.com/Forums/en-US/f9f011e2-59fc-42d3-a1a4-251536ce8287/i-need-to-automatically-run-an-app-at-logoff?forum=win10itprosetup).Lastly, we can also go over a reference code for “logoff.exe” from ReactOS (https://github.com/reactos/reactos/tree/3fa57b8ff7fcee47b8e2ed869aecaf4515603f3f/base/applications/logoff).

See you next time ;-) You can also follow me on twitter — @boutnaru (https://twitter.com/boutnaru).