Step by Step Guide to Fix Windows Error  0x00000047

0x00000047 Error: REF_UNKNOWN_LOGON_SESSION

Try it yourself, or Reach Out!

If you still need a hand, we’re just a plan away

What is 0x00000047 Error?


The Windows Stop Code 0x00000047, also known as REF_UNKNOWN_LOGON_SESSION, is a Blue Screen of Death (BSOD) that happens when a kernel-mode process tries to reference a logon session that the system doesn't recognise or that no longer exists. It generally reflects errors in how a driver or system component tracks and interacts with user authentication sessions. This BSOD can surface when logging in or out, switching users, or when security software or drivers interact incorrectly with user identity tokens.

Causes

  • Faulty or Incompatible Kernel Drivers: Drivers that incorrectly reference logon session tokens.
  • Improper Security Software Behaviour: Endpoint tools or antivirus software mismanage identity handling.
  • Logon Session Tracking Bugs: Flaws in user authentication or impersonation processes.
  • Corrupt Security Subsystem Files: Damage to components responsible for session validation.
  • Buggy User Session Cleanup: Failed cleanup or incorrect reuse of expired session handles.
  • Remote or Domain Session Handling Issues: Errors when using Remote Desktop or Active Directory logins.

Resolution Steps




1. Use Driver Verifier to Detect Driver Issues

  • Run verifier from Command Prompt (Admin)
  • Select “Create standard settings” → Automatically select all drivers
  • Reboot and let BSOD trigger if necessary
  • Use WinDbg or BlueScreenView to analyse the memory dump
  • After debugging, disable Verifier:

verifier /reset

2. Update Kernel-Level Drivers and Software

  • Go to Device Manager
  • Update drivers for Network Adapters, System Devices, and Security Devices
  • Revert recent updates if BSOD began after installation
  • Make sure all endpoint protection tools are fully compatible with your Windows version

3. Uninstall Recently Installed Security Tools

  • Navigate to Control Panel → Programs → Uninstall a program
  • Remove any recently added antivirus or identity monitoring software
  • Restart and test system stability
  • Use Microsoft’s Windows Security temporarily to isolate the issue

4. Run System File Checker and DISM Repair

  • Open Command Prompt as Admin
  • Run:

sfc /scannow

  • Follow with:

DISM /Online /Cleanup-Image /RestoreHealth

  • These tools repair corrupt system files related to user authentication and session handling

5. Perform a Clean Boot to Identify Conflicts

  • Type msconfig in Run (Win + R)
  • Under Services, check “Hide all Microsoft services” → Click Disable all
  • Go to Startup tab, open Task Manager → Disable all items
  • Restart the system and check if the BSOD still occurs

6. Restore to a Previous Stable State

  • Open Control Panel → Recovery → Open System Restore
  • Select a restore point before the appearance of the BSOD
  • Let the system roll back to that configuration
  • This helps revert faulty registry or session handling changes

7. Verify Domain Session Policies (if domain-connected)

  • Ensure domain logon policies, session impersonation scripts, and group policies are up-to-date and not referencing stale tokens
  • Check Event Viewer logs under Security for failed session authentication attempts

We’re Here for You!


Follow our step-by-step instructions to troubleshoot the issue. Still need help?
Contact us and choose a plan, and our experts will take care of it for you.

Transparent Pricing

Simple, upfront pricing with no hidden fees or surprises

Endpoints

  • Desktops$49
  • Laptops$49
  • Mobile Devices (MDM)$19
  • Workstations$69
  • POS/Kiosks$49
  • Network Printers$29
  • Purchase Now

Network

  • Routes$29
  • Switches$15
  • Firewalls$29
  • Access Points$9
  • VPN Gateways$19
  • Load Balancers$49
  • Purchase Now

Server

  • On-Prem Servers$99
  • Virtual Servers$69
  • Cloud Servers$99
  • Storage Systems (NAS/SAN)$49
  • Backup Appliances$99
  •   
  • Purchase Now

Security

  • Endpoint Protection (EDR)$9
  • AV/Antimalware$9
  • Patch Management$9
  • Web Filtering$9
  • MFA$5
  •   
  • Purchase Now

BDR

  • Local Backup$49
  • Cloud Backup$49
  • DR Infrastructure$199
  •   
  •   
  •   
  • Purchase Now

Compliance

  • Policy Mgmt & Audits$149/month
  • DLP$5/user
  • IT Governance Tools$199/month
  •   
  •   
  •   
  • Purchase Now

NOC

  • 24/7 Monitoring$10/device
  • RMM Tools$3/device
  • MDR Service$25/device
  •   
  •   
  •   
  • Purchase Now

SOC & SIEM

  • Threat Intelligence$199/month
  • Cloud SIEM (Sentinel, etc.)$200–$1000+
  •   
  •   
  •   
  •   
  • Purchase Now

Helpdesk

Open a Ticket / Contact Us

Need help now or want to explore partnership options?

Subscribe our newsletter to stay updated!