Multi-Factor Authentication for User Disabled
Sent when a user disables multi-factor authentication for a specific user if it is used as a service account. For more information, see DIsabling MFA for Service Accounts.
General Information
Event ID: 40204
Event message details: Multi-factor authentication has been disabled for <UserName> by <UserName>
Severity: Info
Parameters
Parameter Name | Description | Example |
|---|---|---|
UserFullInfo | Detailed information about the user who performed an operation. Includes the following data:
| UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />" |
VbrHostName | Backup server name. Can be a DNS name, an FQDN or an IP address. | VbrHostName="vbrsrv01.tech.local" |
VbrVersion | Veeam Backup & Replication version. | VbrVersion="12.3.1.1139" |
Version | Event version (service parameter). | Version="1" |
Description | Event message details. | Description="Multi-factor authentication has been disabled for TECH\user2 by TECH\user1." |
Syslog Message Example
1 2025-03-24T09:52:28.777565-07:00 VBRSRV01 Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=40204 UserFullInfo="<ModifiedUserInfo fullName="TECH\user1" loginType="0" />" VbrHostName="vbrsrv01.tech.local" VbrVersion="12.3.1.1139" Version="1" Description="Multi-factor authentication has been disabled for TECH\user2 by TECH\user1."] |
