Event ID:
4779
Category:
Logon/Logoff
Subcategory:
Other Logon/Logoff Events
Supported on:
Windows Vista, Windows Server 2008
A session was disconnected from a Window Station.
Subject:
Account Name: %1
Account Domain: %2
Logon ID: %3
Session:
Session Name: %4
Additional Information:
Client Name: %5
Client Address: %6
This event is generated when a user disconnects from an existing Terminal Services session, or when a user switches away from an existing desktop using Fast User Switching.