SOC Event Lookup
Event ID 4779LogonP3

Windows Event ID 4779: A session was disconnected from a Window Station

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4779 records disconnection from an existing Terminal Services, Fast User Switching, or Hyper-V Enhanced Session desktop session.

Technical Metadata

Technical metadata for Event ID 4779
Event ID4779
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0008 Lateral Movement / T1021.001 Remote Services: Remote Desktop Protocol
Key fields to watchAccount Name / Account Domain / Logon ID, Session Name, Client Name / Client Address

Trigger Scenarios

Microsoft documents that this event is generated when a user disconnects from an existing Terminal Services session or switches away from an existing desktop.

Key Fields

Account Name / Account Domain / Logon ID

The user and hexadecimal session identifier associated with the disconnect.

Session Name

The terminal session name associated with the disconnect, commonly an RDP-Tcp session.

Client Name / Client Address

The endpoint associated with the disconnected session.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4779
SecurityEvent
| where EventID == 4779
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4779
index=wineventlog source="WinEventLog:Security" EventCode=4779
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 4779
dataset = microsoft_windows_raw
| filter edr_event_id = 4779
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4779
title: Windows Security Event ID 4779
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4779
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
SessionNameRDP-Tcp#0An example Remote Desktop session name in the Microsoft event reference.Interpret SessionName with the other documented fields and correlated events; this value alone is not proof of compromise. Source
ClientAddressnetwork addressThe client address associated with the disconnected session.Interpret ClientAddress with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1021.001Remote Services: Remote Desktop Protocol

Detection Notes

Investigate 4779 when Client Address belongs to an unusual external/VPN host and the same Logon ID later reconnects through 4778, especially for administrators. Microsoft documents Client Address and Session Name fields; repeated RDP-Tcp disconnect/reconnect cycles can preserve T1021.001 Remote Desktop Protocol access while reducing full logon visibility. Correlate with 4624 Type 10, 4648 explicit credentials, and commands run after reconnection.

Common False Positives

  • Normal RDP disconnects, network drops, and users closing the RDP client are common.
  • Fast User Switching and Hyper-V Enhanced Session disconnects can be benign.

Related Events

Sample Log

Sanitized event sample
EventID: 4779
Account Name: admin
Account Domain: CORP
Logon ID: 0x169e9
Session Name: RDP-Tcp#0
Client Name: LAPTOP42
Client Address: 10.42.42.211

Frequently Asked Questions

What does Windows Event ID 4779 mean?

A user disconnected from a Window Station session without necessarily logging off.

Does Event ID 4779 always indicate malicious activity?

No. Normal RDP disconnections, network interruptions, and session switching generate it.

How should Event ID 4779 be investigated?

Correlate LogonId with 4624 and 4778 and review activity immediately before and after the disconnect.

Sources