Event ID: 6420

A device was disabled.

A device was disabled.

    Security ID:        %1
    Account Name:       %2
    Account Domain:     %3
    Logon ID:       %4

Device ID:  %5

Device Name:    %6

Class ID:       %7

Class Name: %8

Hardware IDs:   %9

Compatible IDs: %10

Location Information:   %11

This event generates every time specific device was disabled.

Recommended Auditing
Always enable auditing of this sub category.


Microsoft Documentation

Event ID - 6420

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /category:"Detailed Tracking"

LEFT/RIGHT arrow keys for navigation

Back to List