Windows Event ID 4803: The screen saver was dismissed
Written when the screen saver is dismissed. Paired with invocation 4802, it captures return from being away.
Overview
The subcategory is Audit Other Logon/Logoff Events. It is generated when the screen saver is dismissed (activity resumes).
How it is triggered
- Dismissal of the screen saver when the user resumes activity.
Security review points
- Pairing invocation 4802 with dismissal 4803 reveals when a person returned to the machine. Read it as the start of interactive activity together with operations right after.
- Its standalone priority is low. Use it as part of the presence timeline.
Notes for log review
Key fields
| Field | Meaning |
|---|---|
Target Account\Account Name | The target account |
Session ID | The target session |