Event ID: 4778

A session was reconnected to a Window Station 

A session was reconnected to a Window Station.

Subject:
    Account Name:   %1
    Account Domain: %2
    Logon ID:       %3

Session:
    Session Name: %4

Additional Information:
    Client Name:    %5
    Client Address: %6

This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.


This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.

This event also generates when user reconnects to virtual host Hyper-V Enhanced Session, for example.

Auditing:     Always


Volume:     Low Medium


NIST 800-171: 3.1.11
NIST SP 800-53: AC-12
CMMC v2 L2: AC.L2-3.1.11


Microsoft Documentation

Event ID - 4778



Name Field Insertion String OS Example
Account Name AccountName %1 Any ladmin
Account Domain AccountDomain %2 Any DOMAIN
Logon ID LogonID %3 Any 0x1e01f6
Session Name SessionName %4 Any RDP-Tcp\#6
Client Name ClientName %5 Any ComputerName
Client Address ClientAddress %6 Any 192.168.0.10

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows Vista Windows 2008 Windows 2008 R2 Windows 7 Windows 2012 Windows 2012 R2 Windows 8 Windows 8.1 Windows 10 Windows 2016 Windows 2019 Windows 11 Windows 2022

Tags:
Audit Success NIST 800-171 NIST SP 800-53 CMMC L3
Audit Category:
Logon/Logoff

Audit Subcategory:
Other Logon/Logoff Events
Legacy Events:
682

LEFT/RIGHT arrow keys for navigation

Back to List