BSOD 0x47 (REF_UNKNOWN_LOGON_SESSION): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A kernel component referenced a logon-session object that was not known to the security subsystem.

Could be also:
Constant	Type	OS
ERROR_REQ_NOT_ACCEP	Win32 error	Windows
EPROTO	errno	Linux
EREMOTE	errno	Mac
EPROTO	errno	Solaris

Previous	Next
DEREF_UNKNOWN_LOGON_SESSION	CANCEL_STATE_IN_COMPLETED_IRP

REF_UNKNOWN_LOGON_SESSION

Unknown logon-session reference for REF_UNKNOWN_LOGON_SESSION

REF_UNKNOWN_LOGON_SESSION is bug check code 0x00000047.

This is the reference-side partner of DEthis result. It indicates that the kernel attempted to acquire a reference on a logon-session object that was not valid in the current security bookkeeping.

How to read it in a dump

Check whether the crash occurred during logon, logout, token creation, impersonation, or audit processing.
The relevant evidence is the token/logon-session object, not the user name alone.
A stale pointer or object lifetime bug can present as an unknown session.

What to check

Review security and authentication filters, EDR/AV products, and token-manipulation code.
Compare reference and dereference crashes if both occur.
Look for pool corruption around security objects.

References

Looking for a different code? Search another status or error code.