Event ID: 6420A device was disabled.
A device was disabled. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Device ID: %5 Device Name: %6 Class ID: %7 Class Name: %8 Hardware IDs: %9 Compatible IDs: %10 Location Information: %11
This event generates every time specific device was disabled.
Always enable auditing of this sub category.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
LEFT/RIGHT arrow keys for navigationBack to List