Event ID 4779Audit SuccessSecurity
Windows Event ID 4779 — Session Disconnected from Window Station
Logged when a user disconnects from a Remote Desktop session without fully logging off — the session remains active in memory.
Why It Matters
Disconnected RDP sessions (not logged off) remain alive and can be reconnected without re-authentication if an attacker gains access to the system. They also keep credentials cached in memory.
Key Fields
Account NameThe user who disconnected
Client Name / Client AddressThe system they disconnected from
Investigation Tips
- 1.Many disconnected (not logged off) sessions on a server increase the attack surface.
- 2.Check if a 4778 follows this event from an unexpected IP — someone reconnected to the abandoned session.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 4779 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →