WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Other Logon/Logoff

Other Logon/Logoff Events

This category groups together logon related events associated with screen saver, console locking and Remote Desktop connections. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event IDTitle
4778 A session was reconnected to a Window Station.
4779 A session was disconnected from a Window Station.
4800 The workstation was locked.
4801 The workstation was unlocked.
4802 The screen saver was invoked.
4803 The screen saver was dismissed.

Back to top

 

Additional Resources