Windows Event ID 4647: User initiated logoff
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Event ID 4647 records a user-initiated logoff and distinguishes an explicit sign-out from a session ending for another reason.
Technical Metadata
| Event ID | 4647 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | No reliable mapping listed |
| Key fields to watch | Subject, Logon ID, Computer |
Trigger Scenarios
Windows logs this event when an interactive user chooses to sign out.
Key Fields
Subject
The account initiating the logoff.
Logon ID
Correlate with 4624, 4634, and process activity in the same session.
Computer
The host where the session ended.
Threat Hunting Queries
SecurityEvent
| where EventID == 4647
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4647
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4647- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4647
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4647
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
No reliable mapping listed.
Detection Notes
Event ID 4647 has no direct ATT&CK technique mapping because a user-initiated logoff is session-lifecycle evidence, not an attack behavior. Use LogonId to pair it with 4624 and 4634; for a suspicious correlated 4624 Logon Type 10 session, the presence or absence of 4647 helps distinguish user logoff from disconnect or forced cleanup before reviewing associated 4688 activity.
Common False Positives
- Normal user sign-outs are expected.
- Kiosk and shared-host workflows can produce frequent logoffs.
Related Events
Sample Log
Subject: CORP\jsmith
Logon ID: 0x1a2b3cFrequently Asked Questions
What does Windows Event ID 4647 mean?
Event ID 4647 records that a user initiated a logoff and identifies the account and Logon ID for the session.
How is Event ID 4647 different from 4634?
Event ID 4647 explicitly records user initiation, while 4634 records termination of a logon session and can occur without an interactive user selecting logoff.
Does Event ID 4647 indicate malicious activity?
No. It is session-lifecycle telemetry; use Logon ID to bound a suspicious session and compare it with the corresponding 4624 logon, process activity, and 4634 termination.
Sources
- 4647: Microsoft Windows security auditing event reference
Microsoft · vendor
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule