Event ID 4647User initiated logoff

What to check

Use it with 4634 to tell a deliberate logoff apart from a session that simply ended.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4647 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

1
2
3
4
5SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4647
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Sign-in events

• Event ID 4624: An account was successfully logged on
• Event ID 4625: An account failed to log on
• Event ID 4634: An account was logged off
• Event ID 4648: A logon was attempted using explicit credentials
• Event ID 4672: Special privileges assigned to new logon
• Event ID 4776: The computer attempted to validate the credentials for an account

Search all 123 event IDs →