Logon Logoff Event: 4803

Active Directory Auditing Tool

The Who, Where and When information is very important for an administrator to have complete knowledge of all activities that occur on their Active Directory. This helps them identify any desired / undesired activity happening. ADAudit Plus assists an administrator with this information in the form of reports. In real-time, ensure critical resources in the network like the Domain Controllers are audited, monitored and reported with the entire information on AD objects - Users, Groups, GPO, Computer, OU, DNS, AD Schema and Configuration changes with 200+ detailed event specific GUI reports and email alerts.

Logon Logoff » Logon Logoff Event: 4803

Event ID 4803 – The Screen Saver Was Dismissed

Event ID 4803
Category Logon/Logoff
Sub-Category Other Logon/Logoff Events
Type Success Audit
Description The screensaver was dismissed.

Event 4803 is generated when a user unlocks the workstation, thus dismissing the screensaver. This event is preceded by the logging of 4802, which is the activation of the screensaver. This event has a direct relationship with other events, such as the unlocking of the console (event ID 4801).

The activation of the screensaver implies that the console is locked.

This log provides the following information:

  • Security ID
  • Account Name
  • Account Domain
  • Logon ID
  • Session ID

Why does event ID 4803 need to be monitored?

  • Primarily being an informational event, we can monitor it to get information on when a screensaver is dismissed, and which account dismissed it
  • To monitor actions of high value accounts
  • To detect anomalies and malicious actions
  • To ensure non-active, external, and restricted accounts are not used
  • To ensure that only white-listed accounts perform certain specific actions
  • To enforce conventions and compliances

Pro Tip:

With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all Windows Workstation changes, helping you meet your security, compliance, and operational needs with absolute ease.

Event 4803 applies to the following operating systems:

  • Windows 2008 R2 and 7
  • Windows 2012 R2 and 8.1
  • Windows 2016 and 10

Explore Active Directory auditing and reporting with ADAudit Plus.

  •  
  •  
  •  
  • By clicking 'Schedule a personalized demo' you agree to processing of personal data according to the Privacy Policy.
Account Management Auditing
Active Directory Auditing
Windows Server Auditing