Windows BSOD Error 0x00000047 — What It Means & How to Fix It

What Does This Error Mean?

BSOD 0x00000047 (REF_UNKNOWN_LOGON_SESSION) means the Windows security subsystem tried to reference a logon session that no longer exists or was never properly registered. This is a critical failure in the authentication and session management layer. It is usually triggered by corrupted Windows security files, a buggy security driver, or malware tampering with Windows session management.

Affected Models

Windows 10
Windows 11
Windows 8.1
Windows 7

Common Causes

Corrupted Windows security or authentication system files, often after a bad update or abrupt shutdown
Malware or a rootkit has tampered with Windows session management structures
A third-party security software driver has interfered with the Windows logon session registry
An incomplete Windows Update left security subsystem files in a mismatched state
Corrupted user profile data or a damaged Security Accounts Manager (SAM) database

How to Fix It

Run a full malware scan immediately. Open Windows Security > Virus & Threat Protection > Scan Options > Full Scan. Also download and run Malwarebytes Free. Tampering with the Windows logon session system is a known rootkit behavior.

Do not skip this step even if you think you have not visited unsafe websites. Some malware arrives through software downloads or email attachments and specifically targets authentication systems.
Run System File Checker to repair corrupted Windows security files. Open Command Prompt as Administrator (right-click Start > Terminal (Admin)) and type: sfc /scannow — then press Enter. Wait for it to complete fully.

SFC specifically looks for and replaces damaged Windows system files, including security and authentication components. Run it at least twice — sometimes a second pass repairs files the first pass could not.
Run DISM to repair the Windows component store. In the same Administrator Command Prompt, type: DISM /Online /Cleanup-Image /RestoreHealth — then press Enter. This downloads clean Windows files from Microsoft's servers to use as repair sources.

DISM should be run before or after SFC. Together, they address both the component store and the installed system files. Allow up to 30 minutes for DISM to complete.
Repair your Windows user profile. Open Control Panel > User Accounts > Manage another account. Create a new Administrator account. Log into the new account and check if the BSOD still occurs. If it does not, your original profile may be corrupted.

A corrupted user profile can cause logon session errors. Migrating to a new profile (copying files from your old profile folder to the new one) resolves this without a full Windows reinstall.
Use System Restore to revert to a point before crashes began. Type 'Create a restore point' in the Start menu, open it, click System Restore, and choose a date before the issue started. System Restore will reverse security file changes without affecting personal files.

If Windows Updates or security software changes triggered the corruption, System Restore is the fastest way back to a working state.

When to Call a Professional

If SFC, DISM, and malware scans do not resolve the crashes, the Windows security subsystem may be deeply corrupted. A technician can repair or rebuild the SAM database and security hive files. If malware is involved, professional removal is the safest route — some rootkits survive standard scans.

Frequently Asked Questions

What is a logon session in Windows?

When you log into Windows, the system creates a logon session — an internal record that tracks your identity, permissions, and credentials for that login. Everything you do while logged in is linked to this session. If Windows tries to access a session that no longer exists or was never properly created, this BSOD occurs. Think of it like trying to use a hotel key card for a room that has been checked out — the lock does not know what to do with it.

Could this happen after changing my Windows password?

In rare cases, yes — especially if the password change did not complete correctly or if cached credentials are now mismatched. Try signing out and signing back in. If you use Windows Hello (PIN or fingerprint), remove and re-add those authentication methods through Settings > Accounts > Sign-in options. Also check that your Microsoft account is properly synced if you use a Microsoft account to sign in.

Does this BSOD mean my account has been hacked?

Not necessarily — but it is worth investigating. Logon session errors are more commonly caused by corrupted Windows files or software bugs than by hacking. However, some malware does target authentication systems. Run a full malware scan, check your Microsoft account login history at account.microsoft.com for unusual sign-ins, and change your password if anything looks suspicious.