Windows Event ID 6423 — The installation of this device is forbidden by system policy — SecOps Tools

Why event 6423 matters

Attempted device installation blocked by policy. High signal — attacker trying to install unauthorized hardware.

How to detect it

Alert on any occurrence. Investigate which device was blocked and who was present.

Log source

Security

Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Exfiltration	Exfiltration over USB (T1052.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 6423   // The installation of this device is forbidden by system policy
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=6423
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# The installation of this device is forbidden by system policy — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 6423 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Plug and Play events

6416 A new external device was recognized by the system 6419 A request was made to disable a device 6420 A device was disabled 6421 A request was made to enable a device 6422 A device was enabled 6424 The installation of this device was allowed after a policy override

Frequently asked questions

What is Windows Event ID 6423?

The installation of this device is forbidden by system policy. Device installation blocked by Group Policy.

Which log records event 6423?

Event 6423 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Plug and Play' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 6423?

Event 6423 is associated with: Exfiltration over USB (T1052.001).

How do you detect activity around event 6423?

Alert on any occurrence. Investigate which device was blocked and who was present.