| Event Id | 4778 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A session was reconnected to a Window Station. Subject: Account Name: <Account Name> Account Domain: <Domain Name> Logon ID: <Logon ID> Session: Session Name: <Session Name> Additional Information: Client Name: <Client Name> Client Address: <Client Address> |
| Event Information | Cause : This event generates when a user reconnects to a disconnected terminal server ( Remote Desktop) session .This event is also logged when a user returns to an existing logon session via Fast User Switching. Resolution : This is an information event and no user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.