Event submitted by Event Log Doctor
Event ID:
4647
Source:
Microsoft-Windows-Security-Auditing
Category:
Logoff

Message:
User initiated logoff:

Subject:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1

This event is generated when a logoff is initiated but the token reference count is not zero and the logon session cannot be destroyed. No further user-initiated activity can occur. This event can be interpreted as a logoff event.


System32 Reference

Windows Security Event ID 4647

Solution by Event Log Doctor

2009-06-10 14:54:28 UTC

This event is usually followed by a 4634 event in case of console logons.

This event can be correlated back to a logon event (4624) using the value of the "Logon ID".


User Information
 
Only an Email address is required for returning users.

Hide Name
Solution
Additional Links