Event ID:
4647
Source:
Microsoft-Windows-Security-Auditing
Category:
Logoff
Message:
User initiated logoff:
Subject:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1
This event is generated when a logoff is initiated but the token reference count is not zero and the logon session cannot be destroyed. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Subject:
Security ID: TESTGROUND\cacheduser
Account Name: cacheduser
Account Domain: TESTGROUND
Logon ID: 0xbed3f1
This event is generated when a logoff is initiated but the token reference count is not zero and the logon session cannot be destroyed. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Solution by Event Log Doctor
Wed Jun 10 14:54:28 -0400 2009This event is usually followed by a 4634 event in case of console logons.
This event can be correlated back to a logon event (4624) using the value of the "Logon ID".