Event ID 4647LogonP2

Windows Event ID 4647: User initiated logoff

Event ID 4647 records a user-initiated logoff and distinguishes an explicit sign-out from a session ending for another reason.

Applicable version: Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed: 2026-07-11

Trigger Scenarios

Windows logs this event when an interactive user chooses to sign out.

Key Fields

Subject

The account initiating the logoff.

Logon ID

Correlate with 4624, 4634, and process activity in the same session.

Computer

The host where the session ended.

Common False Positives

Normal user sign-outs are expected.
Kiosk and shared-host workflows can produce frequent logoffs.

Related Events

MITRE ATT&CK Mapping

T1078Valid Accounts

Detection Notes

Use 4647 to bound a T1078 Valid Accounts session after suspicious remote access. A privileged 4624 Type 10 session that lacks 4647 but ends with 4634 may indicate disconnect or forced termination; compare its Logon ID with 4688 before closing the timeline.

Microsoft Sentinel KQL

SecurityEvent
| where EventID == 4647
| project TimeGenerated, Computer, Account, TargetLogonId

Splunk SPL

index=wineventlog EventCode=4647 | table _time, host, SubjectUserName, TargetLogonId

Sample Log

Subject: CORP\jsmith
Logon ID: 0x1a2b3c

Source

Official documentation Machine-readable JSON