Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know it has been discussed before several times that it is not possible to start an application from an usb drive when connecting it due to limitations of autorun (or autoplay??) in Win 7. But it is possible to create a scheduled task having On an event type trigger and surely there must be an event occurring when the drive is connected.

Does anybody have the slightest idea which Event ID should I use? Or at least what type of event? There are too many logs to pick from.

share|improve this question

5 Answers 5

As I already explained on this discussion (but it was about running a program when a USB drive is removed), USB Safely Remove, although not free, can run a program when some events about USB devices are triggered:

Another USB Safely Remove feature that distinguishes it from similar software is starting any applications not only after connecting a device, but also before removing it. The autorun feature allows you to set up data backup before disconnecting a removable hard drive, to run Total Commander with the contents of the pen-drive, automatically unmount an encrypted TrueCrypt drive before disconnecting the USB media, etc.

enter image description here

Of course, this does not fully answer the question, as it is not about using scheduled tasks, but the goal is the same, I think, which is to run a specific program when a USB stick is plugged in.

share|improve this answer
Thank you very much, a good workaround, it is. I've tried it but in spite of it working properly, I'm still trying to achieve my original goal (that is, using a natively available and free solution). So far I've figured out that using Event ID 2006 events from DriverFrameworks-UserMode I can trigger the action. It's still not perfect though. The necessary info is available in the event details but I cannot filter it for a specific USB drive, so plugging in any USB drive will cause the trigger to fire. –  gemisigo May 26 '11 at 10:37

Try Log: System, Source: Service Control Manager, Event ID 7036. It seems to work for me but there is sometimes a delay of 1 to 2 minutes.

Edit Just noticed Event ID 7036 occurs occasionally after initially plugging in a usb drive, so its probably not a solution. Sorry

share|improve this answer

Try changing the drive letter of the USB flash drive with these instructions: http://www.howtogeek.com/96298/assign-a-static-drive-letter-to-a-usb-drive-in-windows-7/ then use event code 2100. It worked for me.

share|improve this answer
Please add the crucial parts of the link to your answer. This is basically a best practice because of link rot. –  Baarn Aug 28 '12 at 20:04
What good would that do? It's not the drive letter missing causing the problem here, it's the lack of ability to filter on it. –  gemisigo Aug 28 '12 at 20:32

It should be quite easy using EventVwr.

  1. Find the event you want - When I plugged an USB mass storage device it triggered the following events (under application category): 20001, 20003, 7036 and a few other less relevant. Make sure you test those events against other USB devices events to avoid false positives.

  2. right click on the event and click "Attach task to this event" (relevant only in Windows Vista or higher - for XP there's CLI EventTrigger), choose "Start a Program" and point it to the script you want to run.

  3. To pass to the script the event parameters you need have a look in this article. Under the events 20001 and 20003 you can find the UNC path to the new storage. Using Sysinternals Junction utility you can create a links to the UNC paths.

share|improve this answer

As others have mentioned, it seems that System log Event 7036 from the Service Control Manager is the only event which correlates reliably with a USB drive being inserted. I checked this by inserting a USB drive and running the following powershell command to list all event log entries from all sources in the last hour:

get-winevent | where {$_.timecreated -ge (get-date) - (new-timespan -hour 1)}

Unfortunately that Event 7036 is generated every time the Service Control Manager successfully starts or stops any service, so additional filtering is required.

The filtering available in the GUI of Event Viewer / Task Scheduler is quite basic and doesn't allow for any filtering on the event data - it only lets you filter on the metadata which in this case doesn't tell you anything about which service has changed state and what state it has changed to. That is held in "param1" and "param2" of the EventData. The following XPath filter can therefore be used to capture only the relevant service starting up:

  <Query Id="0" Path="System">
    <Select Path="System">*[System[Provider[@Name='Service Control Manager'] and (Level=4 or Level=0) and (band(Keywords,36028797018963968)) and (EventID=7036)]]
  Data[@Name="param1"]="Portable Device Enumerator Service" and

From there you can run your script, ideally with some additional logic in place to check that the USB drive which has been inserted is the one you are interested in.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.