Event ID 4647: User initiated logoff
Written when a user signs out of an interactive or Remote Desktop session themselves.
- Log
- Security
- Category
- Logon
Why it matters
- Shows a deliberate sign-out, as opposed to a session that timed out or was disconnected (see 4779).
What to check
Use it with 4624 (type 2 or 10) to bound an interactive session.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Logoff (Success).