win:security 4779
A session was disconnected from a Window Station.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Logon/Logoff > Audit Other Logon/Logoff Events
- Audit category
- Logon/Logoff
- Audit subcategory
- Audit Other Logon/Logoff Events
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
DISA STIG (workstation); Microsoft audit baseline (dc); Microsoft audit baseline (server); Microsoft audit baseline (workstation); NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Recommended | DISA STIG (workstation); Microsoft audit baseline (workstation); NSA |
| Windows member server | Recommended | Microsoft audit baseline (server); NSA |
| Windows domain controller | Recommended | Microsoft audit baseline (dc); Microsoft audit baseline (server); NSA |
| Windows web server (IIS), internet-facing | Recommended | Microsoft audit baseline (server); NSA |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000560 (workstation): Audit Other Logon/Logoff Events Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 11 V2R11 (2026-10-05) | Names this event | WN11-AU-000565 (workstation): Audit Other Logon/Logoff Events Failure |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000560 (workstation): Audit Other Logon/Logoff Events Success |
| DISA STIG: Advanced audit policy requirementsMicrosoft Windows 10 V3R6 (2026-01-23) | Names this event | WN10-AU-000565 (workstation): Audit Other Logon/Logoff Events Failure |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Network Policy: TS Session Disconnect |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: A session was disconnected from a Window Station. |