ZEKASTRA

SecurityLogon and session

4778 · A session was reconnected to a Window Station

Generated when a user reconnects to an existing Terminal Services session, switches to an existing desktop with Fast User Switching, or reconnects to a Hyper-V Enhanced Session.

01Fields in the event

  • AccountName
  • AccountDomain
  • LogonID
  • SessionName
  • ClientName
  • ClientAddress

02How to use it

ClientName and ClientAddress record the connecting client; SessionName shows the channel (RDP-Tcp#N, Console). Pair with 4779 to build connect and disconnect intervals.

03Caveats

Requires Audit Other Logon/Logoff Events. A new RDP logon (as opposed to a reconnection) is recorded by 4624 with LogonType 10, not by this event.

05Sources

  1. Microsoft Learn — 4778(S) A session was reconnected to a Window Station checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.