Event ID
Source
Category
Message
1077
User32
The attempt by user DOMAIN\someuser to logoff computer WKS123 failed
This message is logged on Windows 8.1 when a user aborts a logoff with the "Cancel" button