4801 The workstation was unlocked
Written when a workstation (screen) is unlocked. Paired with lock 4800, it captures the present/away flow.
Overview
The subcategory is Audit Other Logon/Logoff Events. It is generated when a locked screen is unlocked (re-authenticated). An unlock also relates to a logon-type-7 (Unlock) 4624.
How it is triggered
- Unlocking at the lock screen via password/PIN/biometrics.
Security review points
- Pairing lock 4800 with unlock 4801 reveals when a person returned to that machine. Read it as the start of interactive activity together with operations that begin right after the unlock (process launches, access).
- Unlocks at unexpected times or frequencies should be checked from the angle of unauthorized use of a shared machine or physical access.
Notes for log review
- It occurs daily. Compose a presence timeline together with lock 4800 and logon 4624 (Type 7).
- Its standalone priority is low. Use it as an aid to verifying physical security and working hours.
Key fields
| Field | Meaning |
|---|---|
Target Account\Account Name | The account that unlocked |
Session ID | The target session |