Event ID 6424
The installation of this device was allowed, after having previously been forbidden by policy.The installation of this device was allowed, after having previously been forbidden by policy.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Device ID: %5
Device Name: %6
Class ID: %7
Class Name: %8
Hardware IDs: %9
Compatible IDs: %10
Location Information: %11This event occurs rarely, and in some situations may be difficult to reproduce.
Recommended Auditing
Always enable auditing of this sub category.
Volume
Low
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
LEFT/RIGHT arrow keys for navigation
Back to List