Event ID 4778Audit SuccessSecurity
Windows Event ID 4778 — Session Reconnected to Window Station
Logged when a user reconnects to an existing Remote Desktop session. Indicates RDP re-connection activity.
Why It Matters
Unexpected RDP reconnections — especially to systems that shouldn't have remote access enabled — can indicate an attacker re-establishing a dormant foothold.
Key Fields
Account NameThe user reconnecting
Client Name / Client AddressThe system they are connecting from
Session NameRDP-Tcp#0 etc.
Investigation Tips
- 1.Compare the Client Address to known admin workstations — unexpected IPs warrant investigation.
- 2.Off-hours reconnections to servers or domain controllers are high-priority alerts.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 4778 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →