Event ID 4779: A session was disconnected from a Window Station
Written when a Remote Desktop session is disconnected without signing out.
- Log
- Security
- Category
- Logon
Why it matters
- The session stays alive on the server, with the user's processes still running, until it is reconnected or ended.
What to check
Pair with 4778 to see who reconnected to the session and from where.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events (Success).
MITRE ATT&CK
- T1021.001 Remote Desktop Protocol