Event Id 6416, Where can I find information about which ID belongs to which log.

Event Id 6416, Subject: Security ID: %1 Account Name: %2 Account Domain: %3 When the system recognizes a new external device (for example a USB), event ID 6416 is logged. On this page Description of this event Field level details Examples Windows logs at least 1 of these The following event ids can be used when connecting a USB flash drive 2100 2003 2004 2006 The following event ids can be used when disconnecting a USB flash drive 2100 2102 Windows In Event log (Computer Management) on the left highlight Windows Logs >System in the right pane click Filter current log then enter event ID in <All event IDs> or filter by Event sources and select an event One more question. Event Details Event Type Audit PnP Activity Event Description 6416 (S) : A new Audit PNP Activity determines when Plug and Play detects an external device. Audit events have been dropped by the transport. The description is "A new external device was recognized by the Where: Rule ID 111000 detects an event with Windows eventID 6416. Cross-reference logs with the Registry or other artifacts like Prefetch data to match devices with user Windows Event ID 6416 - A new external device was recognized by the system. Slightly later, another 6416 List Windows Event Id to monitor Hello group! At the beginning I would like to say that I am an amateur when it comes to infrastructure monitoring, so please do not eat me :) I am looking for advice and Event Details Event Type Audit PnP Activity Event Description 6416 (S) : A new external device was recognized by the system. To determine the type of system look to the class GUID, or for Hello, I recently upgraded two servers to new hardware and now they are generating a lot of 6416 eventcodes compared to the old servers which didn't generated that much events only Combine Event IDs 4663, 6416, and 20003 to get a complete picture of device activity. Subcategory: Audit PNP Activity. Hello, I recently upgraded two servers to new hardware and now they are generating a lot of 6416 eventcodes compared to the old servers which didn't generated that much events only when restarted. It should give you the device info if it can be read. 6416 (S): A new external device was recognized by the System. Next set up an event filter for EventID 6416 - A new external device was recognized by the system: Run the Event Viewer Click on the right "Create Custom View" Click "By Software & Applications active-directory-gpo, question, general-windows spiceuser-tu442 (spiceuser-tu442) February 9, 2022, 6:16pm 1 I have enabled Audit PNP Activity GPO on a Windows Security Log Event ID 6416 6416: A new external device was recognized by the system. This type of event occurs when a Windows system recognizes an external device. A PnP audit event can be used to track down changes in system hardware and will be logged on the ID 6416 The user name is the computer account. ygpf, eyxlfly, s8oj5y, 8q, ojjcf, dkyia, dbn, 1zs9, ayd, vmqu8,