Event ID: 6419A request was made to disable a device.
A request was made to disable a device. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Device ID: %5 Device Name: %6 Class ID: %7 Class Name: %8 Hardware IDs: %9 Compatible IDs: %10 Location Information: %11
Always enable auditing of this sub category.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
LEFT/RIGHT arrow keys for navigationBack to List