WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Other Logon/Logoff

Other Logon/Logoff Events

This category groups together logon related events associated with screen saver, console locking and Remote Desktop connections. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4778	A session was reconnected to a Window Station.
4779	A session was disconnected from a Window Station.
4800	The workstation was locked.
4801	The workstation was unlocked.
4802	The screen saver was invoked.
4803	The screen saver was dismissed.

Back to top

 

Upcoming Webinars Identity-First Security for AI Agents: Defending a New Attack Surface Across Cloud and SaaS Forget Prompt Injection: Your First M365 Copilot Security Job Is Paying Off Years of Permission Debt

Additional Resources