Skip to content

Instantly share code, notes, and snippets.

@milnak

milnak/usb-device-events.md

Last active December 28, 2025 21:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save milnak/733bdc14cfb8f6c3434eadf752419fff to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save milnak/733bdc14cfb8f6c3434eadf752419fff to your computer and use it in GitHub Desktop.
Download ZIP
How to monitor USB device events in Windows #windows
Raw
usb-device-events.md

How to monitor USB device events in Windows

Enable event log

Open Event Viewer.

Navigate to: Application and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational

Right click, check "Enable logging", then click OK

View connection events

Get-WinEvent -LogName 'Microsoft-Windows-DriverFrameworks-UserMode/Operational' | Where-Object { $_.Id -in 2003,2004,2006,2010,2100,2101,2105,2106 -and $_.LevelDisplayName -eq 'Information' } | Sort-Object TimeCreated | Select-Object TimeCreated,Message | Format-List

View disconnect events

Get-WinEvent -LogName 'Microsoft-Windows-DriverFrameworks-UserMode/Operational' | Where-Object { $_.Id -in 2100,2102 -and $_.LevelDisplayName -eq 'Information' } | Sort-Object TimeCreated | Select-Object TimeCreated,Message | Format-List

Show WPDBUSENUM identifiers

Events will be in form SWD\WPDBUSENUM\<guid>. To list all of the identifiers, use:

Get-ChildItem 'HKLM:\SYSTEM\ControlSet001\Enum\SWD\WPDBUSENUM' | ForEach-Object { $p=Get-ItemProperty $_.PSPath; [PSCustomObject]@{'Id'=$_.PSChildName; 'Mfg'=$p.Mfg; 'FriendlyName'=$p.FriendlyName } } | Format-List
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment