WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Other Logon/Logoff

Other Logon/Logoff Events

This category groups together logon related events associated with screen saver, console locking and Remote Desktop connections. To configure this category you must use auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4778	A session was reconnected to a Window Station.
4779	A session was disconnected from a Window Station.
4800	The workstation was locked.
4801	The workstation was unlocked.
4802	The screen saver was invoked.
4803	The screen saver was dismissed.

Back to top

 

Upcoming Webinars Securing Every Identity in the Hybrid Era: Building a Unified Strategy Across Cloud, On-Prem, and AI “3 Persistent Privileged Access Methods in Active Directory: How Attackers Stick the Landing with AdminSdHolder, SIDHistory, DCShadow”

Additional Resources