Event ID 4647Audit SuccessSecurity
Windows Event ID 4647 — User Initiated Logoff
Logged when a user explicitly logs off (Start → Logoff). Complements 4634, which covers all session terminations including automatic ones.
Why It Matters
Distinguishing between explicit logoffs and session timeouts can help correlate user activity with other events. When no 4647 is logged for an unexpectedly terminated session, the termination may have been forced.
Key Fields
Account NameThe user who initiated the logoff
Logon IDLinks to the original 4624 session
Investigation Tips
- 1.A 4634 without a preceding 4647 for an interactive session can mean the session was terminated by someone else or by the system.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 4647 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →