Windows Server Security Event 4778:
A session was reconnected to a Window Station.
Account Name: %1
Account Domain: %2
Logon ID: %3
Session Name: %4
Client Name: %5
Client Address: %6
This event is generated when a user reconnects to an existing Terminal Services session, or when a user switches to an existing desktop using Fast User Switching.