#event-id-4779

1 article

Windows Events1

Windows security monitoring dashboard showing Event Viewer with RDP session audit logs in a professional SOC environment

Event 4779

Microsoft-Windows-Security-Auditing

Windows EventInformation

Windows Event ID 4779 – Microsoft-Windows-Security-Auditing: User Session Disconnected

Event ID 4779 logs when a user session is disconnected from a Terminal Services or Remote Desktop session, providing audit trail for remote access monitoring.

March 189 min