1

I would like my Powershell script to detect when I plug in a usb device. I have set the GPOs to block the automatic installation of usb devices.

For now I am using this command to detect when a usb device is plugged in :

$query = SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_LogicalDisk' AND TargetInstance.DriveYpe=23


Register-WmiEvent -Query $query -SourceIdentifier RemovableDiskDetection -Action {...} 

But probably because the device isn't installed, the event is not detected and nothing happens. What sort of query should I use to detect when a usb device is plugged in even if the driver of the usb device are not yet installed on the machine ?

  • There are USB devices other than mass storage devices though? What exactly did you block and what exactly are you trying to see? Unless the GPO malfunctions, a drive device won’t appear. – Daniel B Jul 23 '18 at 14:19
  • No there is no other USB device besides my USB key. I enabled the GPO "Prevent installation of removable devices " and "Prevent installation of devices not described by other policy settings." I want to register a Powershell event that will detect when I plug a usb device is plugged in and will display a message, for example "USB detected". This works well when the GPO are not enabled but I do not want usb devices to be autmatically installed. – M.Brbr Jul 24 '18 at 7:05

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.