Windows SecuritySystem Change

Event 6422: A device was enabled.

A device was enabled.

Technical Details

Windows Security Source

Event ID: 6422

Windows Security- System Change

Event Description

A device was enabled.

Key Log Fields

  • SubjectUserName - Account that enabled the device
  • SubjectDomainName - Domain of the account
  • DeviceId - Device identifier
  • DeviceDescription - Description of the device

Contents