Event ID 4802 – The Screen Saver Was Invoked
|Sub-Category||Other Logon/Logoff Events|
|Description||The screensaver was invoked.|
Event 4802 is generated if a workstation activates the screensaver due to a period of inactivity from the user. Subsequently, when a user returns and unlocks the workstation, event 4803 is generated. This event has a direct relationship with other events, such as the locking of the console (event ID 4800).
The activation of the screensaver implies that the console is locked.
This log provides the following information:
- Security ID
- Account Name
- Account Domain
- Logon ID
- Session ID
Why does event ID 4802 need to be monitored?
- Primarily being an informational event, we can monitor it to get information on when a machine is unlocked, and which account is used for it
- To monitor actions of high value accounts
- To detect anomalies and malicious actions
- To ensure non-active, external, and restricted accounts are not used
- To ensure that only white-listed accounts perform certain specific actions
- To enforce conventions and compliances
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all Windows Workstation changes, helping you meet your security, compliance, and operational needs with absolute ease.
Event 4802 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10