01Fields in the event
- TargetUserSid
- TargetUserName
- TargetDomainName
- TargetLogonId
- SessionId
02How to use it
Use it to bound when a person stopped working at the keyboard inside an interactive session. Match TargetLogonId with the 4624 that opened the session and with the 4801 that ended the lock; the gap between 4800 and 4801 is time the screen was locked, not time the computer was off.
03Caveats
Requires Audit Other Logon/Logoff Events, which is not enabled on every system. A missing 4800 does not show that the screen was never locked; check the audit policy first. The event records the lock request, not who was physically present.
04In the case packs
This event appears in one case pack. Each row below is copied unchanged from the downloadable file; the questions named are where you need it.
VP-01 Windows triage: the payroll workstation on a Saturday
- Rows with this ID
- 2
- Questions
- Question 3
The screen was locked for under five minutes inside the Saturday session. It shows the session stayed open, not that someone else used it.
2026-03-14 07:35:10.0912200,4800,Security,PAY-WS03.kestrel.example,d.aydin,KESTREL,,0x3E7A1F2,,,,The workstation was locked
06Sources
- Microsoft Learn — 4800(S) The workstation was locked checked 2026-11-05