deviceTRUST 19.2 is now available and includes the new macOS Client and an updated iOS Client. See the release notes for more information.

Policy category: Auditing

  1. Policy setting: Raise Event ID 1: SERVICE STARTED
  2. Policy setting: Raise Event ID 2: SERVICE STOPPED
  3. Policy setting: Raise Event ID 11: LICENSE VALIDATED
  4. Policy setting: Raise Event ID 12: LICENSE EXPIRES SOON HARD
  5. Policy setting: Raise Event ID 13: LICENSE EXPIRES SOON SOFT
  6. Policy setting: Raise Event ID 14: LICENSE EXPIRED SOFT
  7. Policy setting: Raise Event ID 15: LICENSE EXPIRED HARD
  8. Policy setting: Raise Event ID 16: LICENSE INVALID
  9. Policy setting: Raise Event ID 21: USAGE
  10. Policy setting: Raise Event ID 101: LOGON
  11. Policy setting: Raise Event ID 102: RECONNECT
  12. Policy setting: Raise Event ID 103: LOGOFF
  13. Policy setting: Raise Event ID 104: DISCONNECT
  14. Policy setting: Raise Event ID 105: PROPERTY CHANGED
  15. Policy setting: Raise Event ID 106: CONTEXT CHANGED
  16. Policy setting: Raise Event ID 111: UNTRUSTED DEVICE BLOCKED
  17. Policy setting: Raise Event ID 112: TRUSTED DEVICE BLOCKED
  18. Policy setting: Raise Event ID 113: TRUSTED DEVICE AUTO UPDATE SUCCEEDED
  19. Policy setting: Raise Event ID 114: TRUSTED DEVICE AUTO UPDATE FAILED
  20. Policy setting: Raise Event ID 201: CUSTOM PROCESS EXECUTED
  21. Policy setting: Raise Event ID 202: CUSTOM PROCESS SUCCEEDED
  22. Policy setting: Raise Event ID 203: CUSTOM PROCESS FAILED
  23. Policy setting: Raise Event ID 301: ACCESS ALLOWED
  24. Policy setting: Raise Event ID 302: ACCESS DENIED
  25. Policy setting: Raise Event ID 303: ACCESS FAILED
  26. Policy setting: Raise Event ID 304: LOGON ABORTED
  27. Policy setting: Raise Event ID 311: EVENT INFO
  28. Policy setting: Raise Event ID 312: EVENT WARNING
  29. Policy setting: Raise Event ID 313: EVENT ERROR
  30. Policy setting: Raise Event ID 321: APPLOCKER RULE
  31. Policy setting: Raise Event ID 322: APPLOCKER RULE FAILED
  32. Policy setting: Raise Event ID 331: APPLICATION TERMINATED
  33. Policy setting: Raise Event ID 332: APPLICATION SHUTDOWN
  34. Policy setting: Raise Event ID 341: POPUP SHOWN
  35. Policy setting: Raise Event ID 342: POPUP FAILED
  36. Policy setting: Raise Event ID 351: REGISTRY UPDATED
  37. Policy setting: Raise Event ID 352: REGISTRY WARNING
  38. Policy setting: Raise Event ID 353: REGISTRY FAILED
  39. Policy setting: Raise Event ID 361: PRINTER MAP
  40. Policy setting: Raise Event ID 362: PRINTER MAP FAILED
  41. Policy setting: Raise Event ID 363: PRINTER UNMAP
  42. Policy setting: Raise Event ID 364: PRINTER UNMAP FAILED
  43. Policy setting: Raise Event ID 365: PRINTER SET DEFAULT
  44. Policy setting: Raise Event ID 366: PRINTER SET DEFAULT FAILED
  45. Policy setting: Raise Event ID 371: APPMASKING UPDATE
  46. Policy setting: Raise Event ID 372: APPMASKING UPDATE FAILED

Policy setting: Raise Event ID 1: SERVICE STARTED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 2: SERVICE STOPPED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 11: LICENSE VALIDATED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 12: LICENSE EXPIRES SOON HARD

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 13: LICENSE EXPIRES SOON SOFT

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 14: LICENSE EXPIRED SOFT

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 15: LICENSE EXPIRED HARD

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 16: LICENSE INVALID

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 21: USAGE

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 101: LOGON

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 102: RECONNECT

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 103: LOGOFF

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 104: DISCONNECT

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 105: PROPERTY CHANGED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 106: CONTEXT CHANGED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 111: UNTRUSTED DEVICE BLOCKED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 112: TRUSTED DEVICE BLOCKED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 113: TRUSTED DEVICE AUTO UPDATE SUCCEEDED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 114: TRUSTED DEVICE AUTO UPDATE FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 201: CUSTOM PROCESS EXECUTED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 202: CUSTOM PROCESS SUCCEEDED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 203: CUSTOM PROCESS FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 301: ACCESS ALLOWED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 302: ACCESS DENIED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 303: ACCESS FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 304: LOGON ABORTED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 311: EVENT INFO

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 312: EVENT WARNING

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 313: EVENT ERROR

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 321: APPLOCKER RULE

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 322: APPLOCKER RULE FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 331: APPLICATION TERMINATED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 332: APPLICATION SHUTDOWN

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 341: POPUP SHOWN

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 342: POPUP FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 351: REGISTRY UPDATED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 352: REGISTRY WARNING

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 353: REGISTRY FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 361: PRINTER MAP

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 362: PRINTER MAP FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 363: PRINTER UNMAP

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 364: PRINTER UNMAP FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 365: PRINTER SET DEFAULT

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 366: PRINTER SET DEFAULT FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 371: APPMASKING UPDATE

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.

Policy setting: Raise Event ID 372: APPMASKING UPDATE FAILED

Determines whether the event is raised within the Windows Event Log.

  • When ENABLED, deviceTRUST will write the event to the Windows Event Log when appropriate.

  • When DISABLED, deviceTRUST will not write the event to the Windows Event Log.

The default behavior is enabled.