ZEKASTRA

SecurityLogon and session

4779 · A session was disconnected from a Window Station

Generated when a user disconnects from a Terminal Services session, switches away with Fast User Switching, or disconnects from a Hyper-V Enhanced Session.

01Fields in the event

  • AccountName
  • AccountDomain
  • LogonID
  • SessionName
  • ClientName
  • ClientAddress

02How to use it

Pair with 4778 and 4624 (LogonType 10) to reconstruct remote session intervals; compare ClientAddress with known internal ranges.

03Caveats

Requires Audit Other Logon/Logoff Events. A disconnection leaves the session running; it is not a logoff.

05Sources

  1. Microsoft Learn — 4779(S) A session was disconnected from a Window Station checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.