WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Other Logon/Logoff

Other Logon/Logoff Events

This category groups together logon related events associated with screen saver, console locking and Remote Desktop connections. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4778	A session was reconnected to a Window Station.
4779	A session was disconnected from a Window Station.
4800	The workstation was locked.
4801	The workstation was unlocked.
4802	The screen saver was invoked.
4803	The screen saver was dismissed.

Back to top

 

Upcoming Webinars Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources