Windows SecurityAuthentication

Event 4647: User initiated logoff.

User initiated logoff.

Technical Details

Windows Security Source

Event ID: 4647

Windows Security- Authentication

Event Description

User initiated logoff.

Key Log Fields

  • TargetUserName - Account name that initiated logoff
  • TargetDomainName - Domain of the account
  • TargetLogonId - Logon ID to correlate with 4624

Contents