Event ID 4800: The workstation was locked
Written when a user locks their screen.
- Log
- Security
- Category
- Logon
Why it matters
- With 4801, it shows when a user was at their machine, which helps build an incident timeline.
What to check
Compare activity during the locked period with what the user could have done themselves.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events (Success).