SOC Event Lookup
Event ID 4647LogonP2

Windows Event ID 4647: User initiated logoff

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Event ID 4647 records a user-initiated logoff and distinguishes an explicit sign-out from a session ending for another reason.

Technical Metadata

Technical metadata for Event ID 4647
Event ID4647
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKNo reliable mapping listed
Key fields to watchSubject, Logon ID, Computer

Trigger Scenarios

Windows logs this event when an interactive user chooses to sign out.

Key Fields

Subject

The account initiating the logoff.

Logon ID

Correlate with 4624, 4634, and process activity in the same session.

Computer

The host where the session ended.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4647
SecurityEvent
| where EventID == 4647
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4647
index=wineventlog source="WinEventLog:Security" EventCode=4647
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4647
dataset = microsoft_windows_raw
| filter edr_event_id = 4647
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4647
title: Windows Security Event ID 4647
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4647
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

No reliable mapping listed.

Detection Notes

Event ID 4647 has no direct ATT&CK technique mapping because a user-initiated logoff is session-lifecycle evidence, not an attack behavior. Use LogonId to pair it with 4624 and 4634; for a suspicious correlated 4624 Logon Type 10 session, the presence or absence of 4647 helps distinguish user logoff from disconnect or forced cleanup before reviewing associated 4688 activity.

Common False Positives

  • Normal user sign-outs are expected.
  • Kiosk and shared-host workflows can produce frequent logoffs.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\jsmith
Logon ID: 0x1a2b3c

Frequently Asked Questions

What does Windows Event ID 4647 mean?

Event ID 4647 records that a user initiated a logoff and identifies the account and Logon ID for the session.

How is Event ID 4647 different from 4634?

Event ID 4647 explicitly records user initiation, while 4634 records termination of a logon session and can occur without an interactive user selecting logoff.

Does Event ID 4647 indicate malicious activity?

No. It is session-lifecycle telemetry; use Logon ID to bound a suspicious session and compare it with the corresponding 4624 logon, process activity, and 4634 termination.

Sources