The user is logged off when the user exits the shell or ExitWindows is called. The logoff results in the destruction of all desktops, windows and menus within the windowstation not owned by the logon process. The USER32 server then notifies the logon thread via event that the logoff has occurred.
A logoff also occurs if the windowstation is taken off line and destroyed. In this case, the windowstation's logon thread is also terminated.