Windows Security Log Event ID 4800

4800: The workstation was locked

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event

When either a user manually locks his workstation or the workstation automatically locks its console after a period of inactivity this event is logged.

To find out when the user returned and unlocked the workstation look for event ID 4801.

There is a relationship between this event and 4802 (screen saver invoked) but I can't quite make it out.  For Interactive logons you may see this event or 4802.

Free Security Log Quick Reference Chart

Description Fields in 4800 Subject: The user and logon session involved. Security ID:  The SID of the account. Account Name: The account logon name. Account Domain: The domain or - in the case of local accounts - computer name. Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.  Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session. Top 10 Events to Monitor Examples of 4800 The workstation was locked. Subject:    Security ID:  WIN-R9H529RIO4Y\Administrator    Account Name:  Administrator    Account Domain:  WIN-R9H529RIO4Y    Logon ID:  0x1be4b    Session ID: 1 Keep me up-to-date on the Windows Security Log. Email*: *We will NOT share this

Training for the Windows Security Log Security Log Secrets In-Depth Training On-Site or On-Demand Security Log Resource Kit

Mini-Seminars Covering Event ID 4800 Security Log Exposed: What is the Difference Between “Account Logon” and “Logon/Logoff” Events?

Discussions on Event ID 4800 Ask a question about this event