Event ID: 4779

A session was disconnected from a Window Station 

A session was disconnected from a Window Station.

Subject:
    Account Name:   %1
    Account Domain: %2
    Logon ID:       %3

Session:
    Session Name:       %4

Additional Information:
    Client Name:        %5
    Client Address:     %6


This event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.


This event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.

This event also generated when user disconnects from virtual host Hyper-V Enhanced Session, for example.

Auditing:     Always


Volume:     Low Medium


NIST 800-171: 3.1.11
NIST SP 800-53: AC-12
CMMC v2 L2: AC.L2-3.1.11


Microsoft Documentation

Event ID - 4779



Name Field Insertion String OS Example
Account Name AccountName %1 Any ladmin
Account Domain AccountDomain %2 Any DOMAIN
Logon ID LogonID %3 Any 0x1e01f6
Session Name SessionName %4 Any RDP-Tcp\#3
Client Name ClientName %5 Any ComputerName
Client Address ClientAddress %6 Any 192.168.0.10

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows Vista Windows 2008 Windows 2008 R2 Windows 7 Windows 2012 Windows 2012 R2 Windows 8 Windows 8.1 Windows 10 Windows 2016 Windows 2019 Windows 11 Windows 2022

Tags:
Audit Success NIST 800-171 NIST SP 800-53 CMMC L3
Audit Category:
Logon/Logoff

Audit Subcategory:
Other Logon/Logoff Events
Legacy Events:
683

LEFT/RIGHT arrow keys for navigation

Back to List