Windows Event ID 4779 — Session Disconnected from Window Station
Logged when a user disconnects from a Remote Desktop session without fully logging off — the session remains active in memory.
Why It Matters
Disconnected RDP sessions (not logged off) remain alive and can be reconnected without re-authentication if an attacker gains access to the system. They also keep credentials cached in memory.
Key Fields
Investigation Tips
- 1.Many disconnected (not logged off) sessions on a server increase the attack surface.
- 2.Check if a 4778 follows this event from an unexpected IP — someone reconnected to the abandoned session.
Seeing Event ID 4779 in your own logs? Upload an .evtx file — EventPeeker flags session disconnected from window station automatically, maps it to MITRE ATT&CK, and writes the triage report. No account, files auto-deleted.
Analyze my logs →Related Event IDs
Have Event ID 4779 open in Event Viewer?
In Event Viewer: right-click the event → Copy → Copy Details as XML, then paste it below. Parsing happens entirely in your browser — the event itself is never uploaded or stored, and it is excluded from session recording. We log only the numeric Event ID.
Go deeper: the full Lateral Movement — Spreading Across the Network guide
Builds on this page with the attack chain, step-by-step investigation, immediate containment actions, KQL/Sigma detection queries, and an annotated example log.
Read the Lateral Movement — Spreading Across the Network guide →See Event ID 4779 in your logs
Upload a Windows Event Log (.evtx) file — EventPeeker automatically detects session disconnected from window station patterns, maps findings to MITRE ATT&CK, and generates an AI triage report.
Analyze EVTX Logs Free →