Windows Security Logon Event ID 4800: Workstation Lock After Inactivity
Locked Workstation
FreeReviewedSigma · Informational · v2
- Product
- windows
- Service
- security
- Author
- Alexandr Yampolskyi, SOC Prime (SigmaHQ), DRL 1.1
- Published
- 2019-03-26
- Updated
- 2026-07-31
What it detects
This rule identifies Windows Security events (Event ID 4800) indicating a workstation session was locked automatically after a period of inactivity. Locking sessions helps reduce risk of unauthorized access, but unexpected or frequent lock events can also be a sign of suspicious user activity or environmental changes. It relies on Windows Security log telemetry for EventID 4800 records.
Reporting behind it
- cisecurity.orghttps://www.cisecurity.org/controls/cis-controls-list/
- pcisecuritystandards.orghttps://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- nvlpubs.nist.govhttps://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- ultimatewindowssecurity.comhttps://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
locked-workstation-411742ad
title: "Windows Security Logon Event ID 4800: Workstation Lock After Inactivity"
id: d886479a-9a3a-4e23-9dad-15154b4ad66e
status: stable
description: This rule identifies Windows Security events (Event ID 4800) indicating a workstation session was locked automatically after a period of inactivity. Locking sessions helps reduce risk of unauthorized access, but unexpected or frequent lock events can also be a sign of suspicious user activity or environmental changes. It relies on Windows Security log telemetry for EventID 4800 records.
references:
- https://www.cisecurity.org/controls/cis-controls-list/
- https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
- https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml
author: Alexandr Yampolskyi, SOC Prime, Huntrule Team
date: 2019-03-26
modified: 2023-12-11
tags:
- attack.impact
logsource:
product: windows
service: security
detection:
selection:
EventID: 4800
condition: selection
falsepositives:
- Likely
level: informational
license: DRL-1.1
related:
- id: 411742ad-89b0-49cb-a7b0-3971b5c1e0a4
type: derived