Multi-Factor Authentication for User Enabled

Sent when a user enables multi-factor authentication for a specific user if it is not used as a service account anymore. For more information, see DIsabling MFA for Service Accounts.

General Information

Event ID: 40203

Event message details: Multi-factor authentication has been enabled for <User> by <User>

Severity: Info

Parameters

Parameter Name	Description	Example
UserFullInfo	Detailed information about the user who performed an operation. Includes the following data: fullName — the user name loginType	UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />"
Version	Event version (service parameter).	Version="1"
Description	Event message details.	Description="Multi-factor authentication has been enabled for TECH\user2 by TECH\user1."

Parameter Name

Description

Example

UserFullInfo

Detailed information about the user who performed an operation. Includes the following data:

fullName — the user name
loginType

UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />"

Version

Event version (service parameter).

Version="1"

Description

Event message details.

Description="Multi-factor authentication has been enabled for TECH\user2 by TECH\user1."

Syslog Message Example

<14>1 2023-10-23T20:10:13.151301+02:00 VBRSRV01 Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=40203 UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />" Version="1" Description="Multi-factor authentication has been enabled for TECH\user2 by TECH\user1."]