The workstation was locked
On this page
When either a user manually locks his workstation or the workstation automatically locks its console after a period of inactivity this event is logged.
To find out when the user returned and unlocked the workstation look for event ID 4801.
If a screen saver is used, there is a relationship between this event and 4802/4803 See event ID 4802 for an explanation of the sequence of events.
Free Security Log Quick Reference Chart
The user and logon session involved.
Top 10 Windows Security Events to Monitor
The workstation was locked.
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Account Domain: WIN-R9H529RIO4Y
Logon ID: 0x1be4b
Session ID: 1
Keep me up-to-date on the Windows Security Log.
*We will NOT share this
Go To Event ID: