Event ID: 6420

A device was disabled.

A device was disabled.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:       %4

Device ID:  %5

Device Name:    %6

Class ID:       %7

Class Name: %8

Hardware IDs:   %9

Compatible IDs: %10

Location Information:   %11


This event generates every time specific device was disabled.

Recommended Auditing
Always enable auditing of this sub category.

Volume
Low


Microsoft Documentation

Event ID - 6420



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"



LEFT/RIGHT arrow keys for navigation

Back to List