Windows Security Log · Event 4647
Event 4647: A user initiated the logoff
Someone deliberately signed out, rather than a session simply being torn down. It is the event to use when you actually want to know that a person left, because Event 4634 fires for background sessions too.
Also written as 4647Event ID 4647User initiated logoff
- How oftenFires regularly
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
For an analyst
The reliable marker for interactive sign-out. Pair with 4624 type 2, 7, and 10 to build an accurate picture of human presence on a host during an investigation.
The fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account that signed out.
- TargetLogonId
- The session identifier, matching the 4624 that opened the session.
Ordinary reasons this happens
Most of the time it is one of these.
- A user choosing Sign Out from the Start menu.
- A Remote Desktop session being signed out rather than just disconnected.
- A shutdown or restart signing out the active user first.
What to do next
- Match the Logon ID against the corresponding 4624 to bound the session.
- Compare against 4634 for the same session — 4647 is written first, then the session teardown follows.
- During an investigation, use these to establish whether a person was actually present when something happened.
Common questions
What is the difference between Event 4647 and Event 4634?
4647 means a person deliberately signed out. 4634 means a session ended, which includes the thousands of short network sessions Windows opens for its own purposes. If you want to know that a human left the machine, 4647 is the event to trust.
Does Event 4647 appear when a Remote Desktop session disconnects?
No. Disconnecting leaves the session running, which produces Event 4779 instead. 4647 is written only when the session is genuinely signed out, which is why a disconnected RDP session can stay logged in for days without one appearing.
Read next
- Read alongside Event 4634: An account was logged off The session teardown that follows. 4634 alone does not distinguish a user signing out from a background session ending.
- Usually comes before Event 4624: An account was successfully logged on The sign-in that started the session.
- Related Event 4800: The workstation was locked The workstation being locked, another marker of a user stepping away.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026