// REFERENCE
4779 — Session disconnected (RDP)
Log: Security
Low risk
A remote desktop session was disconnected without logging off. Paired with 4778 it reconstructs the comings and goings of an account's RDP connections.
Related tools
Work with this in:
Related
4624
4624 — Successful logon 4625
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked
4624 — Successful logon 4625
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4800
4800 — Workstation locked 4801
4801 — Workstation unlocked
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.