#event-id-4778

1 article

Windows Events1

Windows Security Event Viewer displaying Event ID 4778 session reconnection logs on a security monitoring dashboard

Event 4778

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 4778 – Microsoft-Windows-Security-Auditing: Session Reconnected to a Window Station

Event ID 4778 logs when a user session reconnects to a Windows workstation or server, typically after Remote Desktop disconnection or console switching. Critical for tracking user activity and session management.

March 189 min