Event ID: 6424The installation of this device was allowed, after having previously been forbidden by policy.
The installation of this device was allowed, after having previously been forbidden by policy. Subject: Security ID: %1 Account Name: %2 Account Domain: %3 Logon ID: %4 Device ID: %5 Device Name: %6 Class ID: %7 Class Name: %8 Hardware IDs: %9 Compatible IDs: %10 Location Information: %11
Always enable auditing of this sub category.
This event occurs rarely, and in some situations may be difficult to reproduce.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /category:"Detailed Tracking"
LEFT/RIGHT arrow keys for navigationBack to List