4800 Security log · Logon/Logoff info severity high volume

Windows Event ID 4800 — The workstation was locked

Workstation locked by user or policy. TargetUserName identifies the account.

Why event 4800 matters

Correlate with 4624 Type 3 logons from the same account's credentials from new IPs while workstation is locked — indicates parallel remote use of stolen credentials.

How to detect it

Use as supporting evidence only. Alert: remote logons occurring while workstation is continuously locked.

Log source
Security
Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4800   // The workstation was locked
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4800
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The workstation was locked — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4800 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4779 A session was disconnected from a Window Station 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4800?

The workstation was locked. Workstation locked by user or policy. TargetUserName identifies the account.

Which log records event 4800?

Event 4800 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

How do you detect activity around event 4800?

Use as supporting evidence only. Alert: remote logons occurring while workstation is continuously locked.