SetupAPI logging supports a global event level and a global event category that control whether information is written to a text log. The event level controls the level of detail that is written to a text log and the event category determines the type of operations that can make log entries. If a log entry has an event level numerically less than or equal to the global event level of a text log, and if the event category of the log entry is enabled for the text log, the log entry is written to the text log; otherwise, the log entry is not written to the text log.
By default, the SetupAPI text logs are located in the %SystemRoot%\Inf directory. For information about how to change the directory where the text logs are located, see Setting the Directory Path of the Text Logs.
Learn to audit and diagnose your Windows Server environment for regulatory compliance, user activity, and troubleshooting. Implement security best practices through regular audits of your network environment to gain early warning of potential malicious activity.