Event ID 4778

A session was reconnected to a Window Station

A session was reconnected to a Window Station.

Subject:
    Account Name:   %1
    Account Domain: %2
    Logon ID:       %3

Session:
    Session Name: %4

Additional Information:
    Client Name:    %5
    Client Address: %6

This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.


This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.

This event also generates when user reconnects to virtual host Hyper-V Enhanced Session, for example.

Auditing:     Always


Volume:     Low Medium


NIST 800-171: 3.1.11
NIST SP 800-53: AC-12
CMMC v2 L2: AC.L2-3.1.11


Microsoft Documentation

Event ID - 4778



Name Field Insertion String OS Example
Account Name AccountName %1 Any ladmin
Account Domain AccountDomain %2 Any DOMAIN
Logon ID LogonID %3 Any 0x1e01f6
Session Name SessionName %4 Any RDP-Tcp\#6
Client Name ClientName %5 Any ComputerName
Client Address ClientAddress %6 Any 192.168.0.10


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"



LEFT/RIGHT arrow keys for navigation

Back to List