Event ID 4778: A session was reconnected to a Window Station
Written when someone reconnects to an existing Remote Desktop session or uses Fast User Switching.
- Log
- Security
- Category
- Logon
Why it matters
- Gives the client name and IP address of the machine that reconnected, which 4624 alone may not show for reconnections.
What to check
Check Client Name and Client Address against the user's usual devices.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events (Success).
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol