01Fields in the event
- TargetUserSid
- TargetUserName
- TargetDomainName
- TargetLogonId
- SessionId
02How to use it
Read it with 4624 logon type 7 (Unlock) on the same computer: both mark a return to an existing session, and the same TargetLogonId ties the unlock to the session that was locked. A 4801 shortly before a file copy or a program run places an account at the console at that moment.
03Caveats
Requires Audit Other Logon/Logoff Events. An unlock proves the account's credentials were used, not who typed them; corroborate with physical access records or other evidence before naming a person.
04In the case packs
This event appears in one case pack. Each row below is copied unchanged from the downloadable file; the questions named are where you need it.
VP-01 Windows triage: the payroll workstation on a Saturday
- Rows with this ID
- 2
- Questions
- Question 3
The unlock returns to the same logon session 0x3E7A1F2; no new 4624 is needed. The device activity that follows in partition-diagnostic.csv falls after this unlock.
2026-03-14 07:39:52.3300014,4801,Security,PAY-WS03.kestrel.example,d.aydin,KESTREL,,0x3E7A1F2,,,,The workstation was unlocked
06Sources
- Microsoft Learn — 4801(S) The workstation was unlocked checked 2026-11-05