Windows Security Log · Event 4800
Event 4800: The workstation was locked
Someone locked the screen, or Windows locked it after a period of inactivity. It is not a security signal by itself — its value is reconstructing when a person was actually present at a machine.
Also written as Event ID 4800The workstation was locked4800 workstation locked
- How oftenFires regularly
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
On a personal computer
Your screen was locked, either by you or automatically after you stepped away. Entirely normal.
For an analyst
Pair 4800 and 4801 to establish when a user was at the keyboard. That matters when you need to know whether a person could have performed an action, or whether it happened while the machine was locked and unattended.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
The workstation was locked.
Subject:
Security ID: CORP\jbrooks
Account Name: jbrooks
Account Domain: CORP
Logon ID: 0x3E9A11
Session ID: 2The fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account whose session was locked.
- TargetLogonId
- The session identifier, matching the 4624 that opened it.
- SessionId
- The Windows session number.
Ordinary reasons this happens
Most of the time it is one of these.
- A user locking the screen before stepping away.
- The screen saver or inactivity timeout locking automatically.
- The machine going to sleep.
- A Remote Desktop session being locked at the console.
What to do next
- Pair each 4800 with the following 4801 to bound periods of absence.
- Compare activity timestamps against those windows — actions during a locked period were not performed by someone at the keyboard.
- Join on Logon ID to attribute the session to a sign-in and a source.
Queries to run
SecurityEvent | where EventID in (4800, 4801) | where TargetUserName == 'jbrooks' | project TimeGenerated, EventID, Computer | order by TimeGenerated ascGet-WinEvent -FilterHashtable @{LogName='Security'; Id=4800,4801} -MaxEvents 50 | Select-Object TimeCreated, Id | Sort-Object TimeCreatedCommon questions
What is the difference between locking and signing out?
Locking leaves the session running with everything open and requires a password to return — recorded as 4800 and 4801. Signing out ends the session and closes everything, recorded as 4647. A locked machine still has the user signed in, which matters when you are working out who could have done what.
Can Event 4800 tell me if someone else used my computer?
Indirectly. What it gives you is the periods when the machine was locked. Activity during a locked window was not performed by someone sitting at the keyboard, so combine it with Event 4624 logon type 7 to see each unlock — those are the moments someone supplied a password to get back in.
Read next
- Read alongside Event 4801: The workstation was unlocked The unlock. The pair bounds a period when nobody was at the machine.
- Usually comes before Event 4624: An account was successfully logged on The sign-in that opened the session. Logon type 7 is specifically an unlock.
- The equivalent of Event 4647: A user initiated the logoff A deliberate sign-out, which ends the session rather than locking it.
Vendor documentation
Last reviewed 28 August 2026