Windows Security Log Event ID 4647

4647: User initiated logoff

On this page

• Description of this event
• Field level details
• Examples

Also see 4634. This event signals the end of a logon session and can be correlated back to the logon event 4624 using the Logon ID.
This event seems to be in place of 4634 in the case of Interactive and RemoteInteractive (remote desktop) logons.  This is a plus since it makes it easier to distinguish between logoffs resulting from an idle network session and logoffs where the user actually logs off with from his console.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4647

Subject:

•  Security ID:  %1
•  Account Name:  %2
•  Account Domain:  %3
•  Logon ID:  %4

Supercharger Enterprise

 

Mini-Seminars Covering Event ID 4647 Security Log Exposed: What is the Difference Between “Account Logon” and “Logon/Logoff” Events? Understanding Logon Events in the Windows Security Log Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs Linking Logon to Logoff and Everything in Between with the Windows Security Log How to do Logon Session Auditing with the Windows Security Log Understanding Logon Events in the Windows Server 2022 Security Log Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs

 

Upcoming Webinars

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy