Windows Security Log Event ID 4647

4647: User initiated logoff

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

Also see 4634. This event signals the end of a logon session and can be correlated back to the logon event 4624 using the Logon ID.
This event seems to be in place of 4634 in the case of Interactive and RemoteInteractive (remote desktop) logons.  This is a plus since it makes it easier to distinguish between logoffs resulting from an idle network session and logoffs where the user actually logs off with from his console.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4647

Subject:

•  Security ID:  %1
•  Account Name:  %2
•  Account Domain:  %3
•  Logon ID:  %4

Supercharger Free Edition

 

Mini-Seminars Covering Event ID 4647 Security Log Exposed: What is the Difference Between “Account Logon” and “Logon/Logoff” Events? Understanding Logon Events in the Windows Security Log Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs Linking Logon to Logoff and Everything in Between with the Windows Security Log How to do Logon Session Auditing with the Windows Security Log Understanding Logon Events in the Windows Server 2022 Security Log Top 6 Security Events You Only Detect by Monitoring Workstation Security Logs

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy