Windows Event ID 6422 — A device was enabled — SecOps Tools

Why event 6422 matters

Same as 6421.

How to detect it

Alert: USB or external device interfaces enabled on restricted systems.

Log source

Security

Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 6422   // A device was enabled
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=6422
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A device was enabled — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 6422 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Plug and Play events

6416 A new external device was recognized by the system 6419 A request was made to disable a device 6420 A device was disabled 6421 A request was made to enable a device 6423 The installation of this device is forbidden by system policy 6424 The installation of this device was allowed after a policy override

Frequently asked questions

What is Windows Event ID 6422?

A device was enabled. A hardware device was enabled.

Which log records event 6422?

Event 6422 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

How do you detect activity around event 6422?

Alert: USB or external device interfaces enabled on restricted systems.