Event ID 4803 – The Screen Saver Was Dismissed
|Sub-Category||Other Logon/Logoff Events|
|Description||The screensaver was dismissed.|
Event 4803 is generated when a user unlocks the workstation, thus dismissing the screensaver. This event is preceded by the logging of 4802, which is the activation of the screensaver. This event has a direct relationship with other events, such as the unlocking of the console (event ID 4801).
The activation of the screensaver implies that the console is locked.
This log provides the following information:
- Security ID
- Account Name
- Account Domain
- Logon ID
- Session ID
Why does event ID 4803 need to be monitored?
- Primarily being an informational event, we can monitor it to get information on when a screensaver is dismissed, and which account dismissed it
- To monitor actions of high value accounts
- To detect anomalies and malicious actions
- To ensure non-active, external, and restricted accounts are not used
- To ensure that only white-listed accounts perform certain specific actions
- To enforce conventions and compliances
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all Windows Workstation changes, helping you meet your security, compliance, and operational needs with absolute ease.
Event 4803 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10