Event ID 4779

A session was disconnected from a Window Station

A session was disconnected from a Window Station.

Subject:
    Account Name:   %1
    Account Domain: %2
    Logon ID:       %3

Session:
    Session Name:       %4

Additional Information:
    Client Name:        %5
    Client Address:     %6


This event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.


This event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.

This event also generated when user disconnects from virtual host Hyper-V Enhanced Session, for example.

Auditing:     Always


Volume:     Low Medium


NIST 800-171: 3.1.11
NIST SP 800-53: AC-12
CMMC v2 L2: AC.L2-3.1.11


Microsoft Documentation

Event ID - 4779



Name Field Insertion String OS Example
Account Name AccountName %1 Any ladmin
Account Domain AccountDomain %2 Any DOMAIN
Logon ID LogonID %3 Any 0x1e01f6
Session Name SessionName %4 Any RDP-Tcp\#3
Client Name ClientName %5 Any ComputerName
Client Address ClientAddress %6 Any 192.168.0.10


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other Logon/Logoff Events"



LEFT/RIGHT arrow keys for navigation

Back to List