Windows Stop Code 0x00000047: REF_UNKNOWN_LOGON_SESSION

Quick Answer

REF_UNKNOWN_LOGON_SESSION (0x00000047) is a Windows stop code that Microsoft describes as very infrequent. Its dedicated documentation confirms the name and value but does not provide a detailed cause, parameter definitions, or a specific repair procedure. The code alone does not identify a faulty account, profile, or driver. Microsoft Learn

If crashes repeat, record their timing, review recent system changes, and preserve a crash dump. This guide provides initial checks for users and a diagnostic path for IT professionals.

What Microsoft Documents

The name refers to a logon session, but Microsoft’s published description does not establish which component caused an individual crash. Avoid assigning a specific internal failure mechanism without supporting diagnostic evidence. Microsoft Learn

Before You Begin

• Back up important files before changing drivers or recovery settings.
• Record the crash time, exact stop code, and any displayed driver filename.
• Note whether the crash occurs during startup, sign-in, sign-out, or another operation.
• Record recent driver, application, and Windows updates.
• Have administrator access available for driver rollback.
• Keep the BitLocker recovery key available before entering recovery options. support.microsoft.com

For a managed computer, involve IT support before changing security or authentication software. This stop code alone does not justify deleting a user profile, resetting credentials, or changing domain membership.

Recommended Troubleshooting

1. Record the Crash Pattern

Note the actions immediately preceding each crash and whether the same operation reproduces it.

If the failure occurs during sign-in, record that detail. The timing is useful evidence, but it does not establish that the account itself is damaged.

2. Review Recent Changes

Compare the first crash with recent hardware installations and software or driver updates.

If newly added external hardware is a plausible lead:

1. Shut down the PC.
2. Disconnect the new device, provided Windows does not depend on it to start.
3. Restart and observe whether the same stop code returns.

Microsoft includes removing recently added hardware among its general stop-error troubleshooting steps. support.microsoft.com

3. Roll Back an Identified Driver Update

If timing or dump evidence points to a recently updated device:

1. Right-click Start and select Device Manager.
2. Open the device’s Properties.
3. Select Driver > Roll Back Driver, when available.
4. Follow the prompts and restart if requested.

If rollback is unavailable or unsuitable, obtain a compatible driver through Windows Update or the device manufacturer’s official website. Match the driver to the device and Windows version. support.microsoft.com

Change one suspected component at a time. If the change creates a new problem, restore the previous driver where possible or reinstall the appropriate vendor package.

4. Install Applicable Windows Updates

In Windows 11, open Settings > Windows Update > Check for updates. Install applicable updates and restart when required.

This is general stop-error troubleshooting. Microsoft does not document a particular update as a universal fix for 0x47. support.microsoft.com

If Windows Cannot Start Normally

1. Access the Windows Recovery Environment.
2. Select Troubleshoot > Advanced options > Startup Settings > Restart.
3. Press 4 or F4 to enable Safe Mode.
4. Investigate or reverse the suspected recent change.
5. Restart normally to test.

Safe Mode starts Windows with a limited set of drivers and services. An encrypted device may request its BitLocker recovery key. These steps use current Windows menus; older versions may differ. support.microsoft.com

Advanced Troubleshooting: Analyze the Crash Dump

Preserve the Relevant Dump

Common default locations are:

A dump exists only if Windows was configured and able to write it. learn.microsoft.com

Run WinDbg Analysis

Open the dump in WinDbg with appropriate symbols and run:

!analyze -v

Review the recorded stop code, call stack, module information, and captured arguments alongside recent changes. This command provides diagnostic information; it does not repair Windows. learn.microsoft.com

Microsoft does not publish 0x47-specific parameter meanings. Do not borrow parameter definitions from another bug check. A module appearing in the stack also requires investigation before being treated as the cause. Microsoft Learn

A small dump can omit information needed for diagnosis. If analysis is inconclusive, support personnel may request a more complete capture. learn.microsoft.com

How to Verify the Fix

1. Restart normally after the targeted correction.
2. Repeat the operation that previously preceded the crash.
3. Confirm that sign-in, affected devices, and applications work.
4. Monitor across multiple sessions if the failure was intermittent.
5. Preserve the newest dump if the error returns.

A successful restart alone does not establish that an intermittent crash has been resolved.

Frequently Asked Questions

Is this the same as an incorrect-password error?

No. It is a Windows bug check. Microsoft’s dedicated page does not identify an incorrect password as its cause. Microsoft Learn

Does this prove that a user profile is corrupt?

No. Profile corruption requires separate evidence. Preserve the profile and its data while investigating.

Does “unknown logon session” indicate unauthorized access?

The stop-code name alone is not evidence of an intrusion. Investigate any security concern using account activity and security logs.

Is 0x47 the same as 0x46?

No. Microsoft assigns 0x47 to REF_UNKNOWN_LOGON_SESSION and 0x46 to DEREF_UNKNOWN_LOGON_SESSION. Record the exact code when collecting evidence. Microsoft Learn

What should I provide to technical support?

Provide the Windows version, computer model, crash times, reproduction steps, recent changes, and WinDbg findings. Share the dump through an approved support channel.

Conclusion

For recurring REF_UNKNOWN_LOGON_SESSION crashes, preserve evidence and investigate recent changes. Microsoft provides limited detail for this rare code, so use crash analysis to guide corrections before making account or profile changes.

Sources

• Microsoft Learn — Bug Check 0x47: REF_UNKNOWN_LOGON_SESSION.
• Microsoft Learn — Bug Check 0x46: DEREF_UNKNOWN_LOGON_SESSION.
• Microsoft Learn — Stop code error or bug check troubleshooting.
• Microsoft Learn — Small Memory Dump.
• Microsoft Support — Update drivers through Device Manager in Windows.
• Microsoft Support — Windows startup settings.
• Microsoft Support — Troubleshooting Windows unexpected restarts and stop code errors.