ZEKASTRA

SecurityLogon and session

4647 · User initiated logoff

Generated when an account starts a logoff through the logoff function. It is most typical for interactive and remote interactive logons.

01Fields in the event

  • TargetUserSid
  • TargetUserName
  • TargetDomainName
  • TargetLogonId

02How to use it

Use it to distinguish a deliberate sign-out from a session that simply ended (4634 only). Correlate TargetLogonId with 4624.

03Caveats

Requires Audit Logoff. Not generated when a session ends through disconnection, shutdown or power loss.

05Sources

  1. Microsoft Learn — 4647(S) User initiated logoff checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.