Event ID 6420
A device was disabled.A device was disabled.
Subject:
Security ID: %1
Account Name: %2
Account Domain: %3
Logon ID: %4
Device ID: %5
Device Name: %6
Class ID: %7
Class Name: %8
Hardware IDs: %9
Compatible IDs: %10
Location Information: %11This event generates every time specific device was disabled.
Recommended Auditing
Always enable auditing of this sub category.
Volume
Low
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
LEFT/RIGHT arrow keys for navigation
Back to List