// REFERENCE
4800 — Workstation locked
Log: Security
Low risk
The workstation was locked (Win+L or by idle timeout). Useful to know when the user stepped away; interactive activity after a 4800 with no preceding 4801 can hint at unauthorized use.
Related tools
Work with this in:
Related
4624
4624 — Successful logon 4625
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
4624 — Successful logon 4625
4625 — Failed logon 4634
4634 — Logoff 4647
4647 — User-initiated logoff 4801
4801 — Workstation unlocked 4778
4778 — Session reconnected (RDP)
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.