Event ID 4647 — Logout initiated by user

The user himself initiated the closure of his session.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Log out from Windows menu
• Voluntary Logoff for a RDP session

Verifications to be carried out

1. Compare to 4634
2. Identify the account concerned

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4647} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.