Log Dejargonizer

Windows Security Log · Event 4801

Event 4801: The workstation was unlocked

Someone supplied credentials to return to a locked session. It closes the bracket opened by Event 4800, and together the pair tell you exactly when a person was physically present at a machine.

Also written as Event ID 4801The workstation was unlocked4801 workstation unlocked

What it means for you

On a personal computer

Someone unlocked the screen with your password or PIN. Normal if it was you.

For an analyst

The strongest available evidence that a human was at the keyboard, because unlocking requires credentials. During an investigation, an unlock at a time the account holder says they were absent is a much sharper question than a sign-in from an unusual address.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The workstation was unlocked.

Subject:
  Security ID:    CORP\jbrooks
  Account Name:   jbrooks
  Account Domain: CORP
  Logon ID:       0x3E9A11

Session ID: 2

The fields that decide it

Everything else in the log line is context.

TargetUserName
The account that unlocked the session.
TargetLogonId
The session identifier, matching the original 4624 and the 4800 lock.
SessionId
The Windows session number.

Ordinary reasons this happens

Most of the time it is one of these.

  • A user returning to their desk.
  • Waking a machine from sleep and signing back in.
  • Reconnecting to a Remote Desktop session that had locked.

When it is not ordinary

Someone using an unattended machine.

What gives it awayUnlocks at times the account holder was demonstrably elsewhere, particularly outside working hours.

ATT&CK T1078

Physical access to a machine left logged in.

What gives it awayAn unlock followed immediately by privileged activity, on a machine in an accessible location.

ATT&CK T1078

What to do next

  1. Pair each 4801 with the preceding 4800 to see how long the machine was locked.
  2. Compare unlock times against when the account holder says they were present.
  3. Look at what the session did in the minutes after the unlock.
  4. Cross-check against 4624 logon type 7, which records the unlock as an authentication.

Queries to run

kql Lock and unlock interleaved, which reads directly as a presence timeline. 
SecurityEvent | where EventID in (4800, 4801) | project TimeGenerated, EventID, Computer, TargetUserName | order by Computer, TimeGenerated asc
kql Unlocks outside normal hours. Worth reading in an investigation, too noisy as a standing alert. 
SecurityEvent | where EventID == 4801 | where hourofday(TimeGenerated) !between (7 .. 19) | project TimeGenerated, Computer, TargetUserName

Common questions

Does Event 4801 mean someone typed a password?

Yes — returning to a locked session requires credentials, whether that is a password, a PIN, or a biometric. That is what makes the lock and unlock pair better evidence of physical presence than most other events.

How do I see when someone was actually using a computer?

Combine Event 4800 and 4801 for locks and unlocks, Event 4624 with logon type 2 or 7 for interactive sign-ins and unlocks, and Event 4647 for deliberate sign-outs. Read in sequence, those give you a fairly complete picture of when a person was at the machine.

Read next

Vendor documentation

Last reviewed 28 August 2026