4779
Microsoft-Windows-Security-Auditing
Other Logon/Logoff Events
Security
A session was disconnected from a Window Station.
Subject:
Account Name: some.user
Account Domain: SOMEDOMAIN
Logon ID: 0x2335b249
Session:
Session Name: RDP-Tcp#0
Additional Information:
Client Name: wksclient04.lo
Client Address: 192.168.1.6
This event is logged by Windows when a user disconnects from an active RDP session