Windows Event ID 4778 – Microsoft-Windows-Security-Auditing: Session Reconnected to a Window Station

Navigate to Event Viewer to examine the specific details of Event ID 4778 occurrences.

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4778 in the Event IDs field and click OK
5. Double-click any Event ID 4778 entry to view detailed information
6. Review the General tab for user account, session ID, and source information
7. Check the Details tab for XML data including client name and IP address
8. Note the Logon ID to correlate with other logon events (4624, 4647, 4777)

Use PowerShell to efficiently query and analyze Event ID 4778 occurrences across your environment.

1. Open PowerShell as Administrator
2. Query recent Event ID 4778 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4778} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4778} | Where-Object {$_.Message -like "*username*"} | Select-Object TimeCreated, Message

4. Export events to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4778} -MaxEvents 100 | Select-Object TimeCreated, Id, @{Name='User';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'}}, @{Name='ClientName';Expression={([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'ClientName'} | Select-Object -ExpandProperty '#text'}} | Export-Csv -Path "C:\Temp\Event4778.csv" -NoTypeInformation

5. Query events from remote computers:

   Get-WinEvent -ComputerName "RemotePC" -FilterHashtable @{LogName='Security'; Id=4778} -MaxEvents 25

Ensure proper audit policy configuration to capture Event ID 4778 and related session events.

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Audit Policies → Logon/Logoff
4. Double-click Audit Logon and enable both Success and Failure auditing
5. Also enable Audit Other Logon/Logoff Events for comprehensive session tracking
6. Apply the policy using:

   gpupdate /force

7. Verify audit settings with:

   auditpol /get /category:"Logon/Logoff"

8. For immediate local configuration without Group Policy:

   auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Create monitoring solutions to track unusual session reconnection patterns that might indicate security concerns.

1. Create a PowerShell monitoring script:

   # SessionMonitor.ps1
   $StartTime = (Get-Date).AddHours(-24)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4778; StartTime=$StartTime}
   
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       
       $UserName = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
       $ClientName = ($EventData | Where-Object {$_.Name -eq 'ClientName'}).'#text'
       $ClientAddress = ($EventData | Where-Object {$_.Name -eq 'ClientAddress'}).'#text'
       $SessionName = ($EventData | Where-Object {$_.Name -eq 'SessionName'}).'#text'
       
       Write-Output "Time: $($Event.TimeCreated) | User: $UserName | Client: $ClientName | IP: $ClientAddress | Session: $SessionName"
   }

2. Schedule the script to run hourly:

   Register-ScheduledTask -TaskName "SessionMonitor" -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)) -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\SessionMonitor.ps1")

3. Create alerts for suspicious patterns:

   # Alert for multiple reconnections from different IPs
   $RecentEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4778; StartTime=(Get-Date).AddMinutes(-30)}
   $UserConnections = $RecentEvents | Group-Object {([xml]$_.ToXml()).Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'}
   
   foreach ($User in $UserConnections | Where-Object {$_.Count -gt 3}) {
       Write-Warning "User $($User.Name) has $($User.Count) reconnections in the last 30 minutes"
   }

Configure Event ID 4778 forwarding and analysis for enterprise security monitoring platforms.

1. Configure Windows Event Forwarding (WEF) for centralized collection:

   # On collector server
   wecutil cs subscription.xml

2. Create subscription XML file for Event ID 4778:

   <?xml version="1.0" encoding="UTF-8"?>
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>SessionReconnections</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Collect Event ID 4778 from domain computers</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4778]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

3. Configure source computers for event forwarding:

   winrm quickconfig
   wecutil qc

4. Set up Splunk Universal Forwarder inputs.conf:

   [WinEventLog://Security]
   disabled = false
   start_from = oldest
   current_only = false
   whitelist = 4778
   index = windows_security

5. Create detection rules for anomalous session patterns in your SIEM platform