logoff.exe

  • File Path: C:\Windows\SysWOW64\logoff.exe
  • Description: Session Logoff Utility

Hashes

Type Hash
MD5 D62B037F763C15D8715980D4B33BFD32
SHA1 CA53527267DD2067462FCF791B0262989BDDCC47
SHA256 44C5395E75BADAE29DFFDCA73F3327D3EE64F70E2E60BA7D7EA367693E622EF5
SHA384 3057DD6E8BBD93134BC11C95706C9DD8A4E325AB0757CBDA6D74BC97BE6945A11F3E8B855C2418EDE9DDE3478EC852C5
SHA512 2E9E1761BBA190B3F6770F6BDDF5539F9E416FBF5499C56A5BD2274AF088A42580D21CBA34F863DC5BABE04DDBFB3D150ADC59B52DB0427103D4EB70DB71CB35
SSDEEP 384:IcmY9Y6rbXSvw/kWmAPlSDCpHMpHD747nx27gCW3PuW:IcmqY6rb/8s2s7
IMP 7221C66767075D303F4DBDE5A363626C
PESHA1 62292F93393BDDEAE43E08784EC5C7C16347518F
PE256 2BF43671282264A37DF51DECC3BBCB0984D0F402893830B800580A97026CE640

Runtime Data

Usage (stderr):

Invalid parameter(s)
Terminates a session.

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V] [/VM]

  sessionname         The name of the session.
  sessionid           The ID of the session.
  /SERVER:servername  Specifies the Remote Desktop server containing the user
                      session to log off (default is current).
  /V                  Displays information about the actions performed.
  /VM                 Logs off a session on server or within virtual machine. The unique ID of the session needs to be specified.


Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\logoff.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: logoff.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/44c5395e75badae29dffdca73f3327d3ee64f70e2e60ba7d7ea367693e622ef5/detection/

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


logoff

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Logs off a user from a session on a Remote Desktop Session Host server and deletes the session.

Syntax

logoff [<sessionname> | <sessionID>] [/server:<servername>] [/v]

Parameters

Parameter Description
<sessionname> Specifies the name of the session. This must be an active session.
<sessionID> Specifies the numeric ID which identifies the session to the server.
/server:<servername> Specifies the Remote Desktop Session Host server that contains the session whose user you want to log off. If unspecified, the server on which you are currently active is used.
/v Displays information about the actions being performed.
/? Displays help at the command prompt.
Remarks
  • You can always log off yourself from the session to which you are currently logged on. You must, however, have Full Control permission to log off users from other sessions.

  • Logging off a user from a session without warning can result in loss of data at the user’s session. You should send a message to the user by using the msg command to warn the user before taking this action.

  • If <sessionID> or <sessionname> isn’t specified, logoff logs the user off from the current session.

  • After you log off a user, all processes end and the session is deleted from the server.

  • You can’t log off a user from the console session.

Examples

To log off a user from the current session, type:

logoff

To log off a user from a session by using the session’s ID, for example session 12, type:

logoff 12

To log off a user from a session by using the name of the session and server, for example session TERM04 on Server1, type:

logoff TERM04 /server:Server1

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.