4802 The screen saver was invoked
Written when the screen saver starts. It is usable for detecting inactivity (being away), a supporting event for the presence timeline.
Overview
The subcategory is Audit Other Logon/Logoff Events. It is generated when the screen saver starts, for example on an inactivity timeout. Paired with dismissal 4803, it tracks away-and-return.
How it is triggered
- The screen saver starting on an inactivity timeout.
Security review points
- It is usable to understand the hours a user is (supposedly) away. If activity occurs under that account while the screen saver is on, it gives cause to suspect use via another path.
- Its standalone security priority is low.
Notes for log review
- It occurs daily. Supplement presence together with dismissal 4803 and lock 4800.
- In many environments it is often not audited.
Key fields
| Field | Meaning |
|---|---|
Target Account\Account Name | The target account |
Session ID | The target session |