Event ID: 6420

A device was disabled.

A device was disabled.

Subject:
    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:       %4

Device ID:  %5

Device Name:    %6

Class ID:       %7

Class Name: %8

Hardware IDs:   %9

Compatible IDs: %10

Location Information:   %11
Microsoft Documentation

Event ID - 6420


Recommended Auditing
Always enable auditing of this sub category.

Volume
Low


This event generates every time specific device was disabled.



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"
How to enable Windows Auditing


Audit Category:
Detailed Tracking

Audit Subcategory:
Plug and Play Events PnP Activity

LEFT/RIGHT arrow keys for navigation

Back to List