Event ID 4801: The workstation was unlocked
Written when a user unlocks their screen. A 4624 with logon type 7 is written at the same time.
- Log
- Security
- Category
- Logon
Why it matters
- Process launches while the screen is locked, with no unlock, did not come from someone at the keyboard.
What to check
Use it with 4800 to bound when the user was present.
How to turn it on
Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events (Success).