I am using Windows 10 and would like to find logs of recent USB insertions on my desktop. Using the built in Event Viewer, where can I find these logs?
I'm not a aware of a full list, so run a tool called EventGhost. When a device is attached or removed you see an event on the left side.
It includes a string with the hardware id. Look for the ID of your mouse
Per scottschlaefli's answer, Windows does not log this event by default. However, you can do this with a third-party utility. One I've found useful to log USB activity: http://www.nirsoft.net/utils/usb_log_view.html
USBLogView is a small utility that runs in the background and records the details of any USB device that is plugged or unplugged into your system. For every log line created by USBLogView, the following information is displayed: Event Type (Plug/Unplug), Event Time, Device Name, Description, Device Type, Drive Letter (For storage devices), Serial Number (Only for some types of devices), Vendor ID, Product ID, Vendor Name, Product Name, and more.
USB insertion is not a logged event in windows event viewer by default. You can create event traces for USB devices using
logman by following these steps located in this Technet article:
In an administrative command prompt enter the following
logman create trace -n usbtrace -o %SystemRoot%\Tracing\usbtrace.etl -nb 128 640 -bs 128 logman update trace -n usbtrace -p Microsoft-Windows-USB-USBXHCI (Default,PartialDataBusTrace) logman update trace -n usbtrace -p Microsoft-Windows-USB-UCX (Default,PartialDataBusTrace) logman update trace -n usbtrace -p Microsoft-Windows-USB-USBHUB3 (Default,PartialDataBusTrace) logman update trace -n usbtrace -p Microsoft-Windows-USB-USBPORT logman update trace -n usbtrace -p Microsoft-Windows-USB-USBHUB logman update trace -n usbtrace -p Microsoft-Windows-Kernel-IoTrace 0 2 logman start -n usbtrace
This will create a trace at
This log can become excessively large and logging all activity for the USB stacks is not going to be a good idea between multiple sessions, this is more for troubleshooting USB activity.
USB disks will cause event ID
4688 to be logged to
Windows>Security when inserted and mounted by the OS, maybe that's enough but there isn't a log entry anytime a USB device is connected. If the concern is removable storage devices you can enforce auditing through Group Policy as described here:
Enforce a GPO with the following:
Computer Configuration>Security Settings>Advanced Audit Policy Configuration>Object Access>Audit Removable Storage>Success (and
Failure if desired) audit event boxes checked.
On a device running Windows 7 or 10 there several events recorded in the Event logs when you plug in a USB device into a system that requires a driver.
You can see USB devices being connected, as well as see when they are disconnected by using the Event Viewer to parse the: "Microsoft/Windows/DriverFrameworks-UserMode/Operational" event log. (By default, this event log is not enabled, so if you're interested in an event that's occurred before you enable this log, you're out of luck.)