Windows Event ID 4800 – The Workstation Was Locked

If a workstation is locked manually by a user or automatically due to inactivity, event 4800 is generated. If a user returns and unlocks the workstation, event 4801 is triggered. In the case of the user using a screensaver, event 4800 is related to events 4802 and 4803.

This log provides the following information:

• Security ID
• Account Name
• Account Domain
• Logon ID
• Session ID

Why does event ID 4800 need to be monitored?

• To monitor when all a workstation is locked, and which accounts are used for that purpose
• To monitor actions of high value accounts
• To detect anomalies and malicious actions
• To ensure non-active, external, and restricted accounts are not used
• To ensure that only white-listed accounts perform certain specific actions
• To enforce conventions and compliances

Pro tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all Windows Workstation changes, helping you meet your security, compliance, and operational needs with absolute ease.