Windows SecurityAuthentication

Event 4801: The workstation was unlocked.

The workstation was unlocked.

Technical Details

Windows Security Source

Event ID: 4801

Windows Security- Authentication

Event Description

The workstation was unlocked.

Key Log Fields

  • TargetUserName - Account that unlocked the workstation
  • TargetDomainName - Domain of the account
  • TargetLogonId - Logon ID for correlation
  • SessionId - Session ID of the unlocked session

Contents