Windows Event ID 4779: A session was disconnected from a Window Station
Windows Security Event ID 4779 records disconnection from an existing Terminal Services, Fast User Switching, or Hyper-V Enhanced Session desktop session.
- Applicable version
- Windows Server 2008 and later where the audit subcategory is enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated when a user disconnects from an existing Terminal Services session or switches away from an existing desktop.
Key Fields
Account Name / Account Domain / Logon ID
The user and hexadecimal session identifier associated with the disconnect.
Session Name
The terminal session name associated with the disconnect, commonly an RDP-Tcp session.
Client Name / Client Address
The endpoint associated with the disconnected session.
Common False Positives
- Normal RDP disconnects, network drops, and users closing the RDP client are common.
- Fast User Switching and Hyper-V Enhanced Session disconnects can be benign.
Related Events
MITRE ATT&CK Mapping
- T1021.001Remote Services: Remote Desktop Protocol
Detection Notes
Investigate 4779 when Client Address belongs to an unusual external/VPN host and the same Logon ID later reconnects through 4778, especially for administrators. Microsoft documents Client Address and Session Name fields; repeated RDP-Tcp disconnect/reconnect cycles can preserve T1021.001 Remote Desktop Protocol access while reducing full logon visibility. Correlate with 4624 Type 10, 4648 explicit credentials, and commands run after reconnection.
SecurityEvent
| where EventID == 4779
| project TimeGenerated, Computer, Account, SessionName, ClientAddress, LogonIDindex=wineventlog EventCode=4779 | table _time, host, Account_Name, Session_Name, Client_Address, Logon_IDEventID: 4779
Account Name: admin
Account Domain: CORP
Logon ID: 0x169e9
Session Name: RDP-Tcp#0
Client Name: LAPTOP42
Client Address: 10.42.42.211