4

I have a Windows 10 computer that every 5 minutes or so, plays the Windows Add/Remove hardware "removal" sound and then a few seconds later plays the "added hardware" sound. Sometimes it does this four or five times in immediate succession.

No changes are being made to the computer, so I suspect I have a faulty peripheral.

Without disconnecting things and waiting to see if it goes away (it could be an on-board peripheral that is flaky, but cannot be physically unplugged) how can I figure out what is causing the add/remove hardware sounds to play? Is there an event in the event log somewhere I can look at?

Update: I have used usblogview which did show an offending peripheral. However even with that peripheral unplugged the issue is still occurring, but now usblogview is not showing anything, which means it's likely not a USB device causing it. Maybe it's the USB chip itself on the motherboard? I have enabled Audit PNP Activity as per HelpingHand's comment however I don't see any events in the event log

Improve this question
9
  • Does this answer your question? What event log should I check for Hardware Changes
    – Romen
    Dec 16, 2019 at 22:10
  • @Romen if it's USB related it might, but it might not be. I have a bunch of non-USB peripherals as well. I'll try it and see
    – Mark Henderson
    Dec 16, 2019 at 22:12
  • Did you check the System logs in Event Viewer? (Which is also mentioned by that possible duplicate)
    – Romen
    Dec 16, 2019 at 22:13
  • 1
    You can turn on such auditing to the Security Event log for PnP. Run: gpedit.msc, then Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking. Audit PNP Activity can then be enabled.
    – HelpingHand
    Dec 16, 2019 at 22:13
  • 1
    @KalamalkaKid I sent the motherboard back to the manufacturer and had them replace it. I don't have that install of Windows any more so I don't have a PNP Activity event to refer to any more, sorry.
    – Mark Henderson
    Apr 30, 2020 at 21:10

1 Answer 1

Reset to default
3

If the device in question is Plug-n-Play (PnP) then you can enable auditing.

To configure locally using the group policy editor:

  1. Launch gpedit.msc
  2. Navigate to:

Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking.

Audit PnP Activity can then be enabled for success/failure.

Local group policy editor

The explanation for this option is as follows:

PNP Activity

This policy setting allows you to audit when plug and play detects an external device.

If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.

Volume: Low

To view the logs, launch the Windows Event Log, e.g. eventvwr and open the Security event log.

If needed, from the command line you can check the state by running:

AuditPol /get /category:"Detailed Tracking"

To enable auditing of failure and success for Plug and Play Events:

AuditPol /set /subcategory:"Plug and Play Events" /failure:enable /success:enable

To disable:

AuditPol /set /subcategory:"Plug and Play Events" /failure:disable /success:disable

Improve this answer
1
  • I found this answer as I started to post this new question: Windows 10 keeps chiming as if a device is being removed. Maybe something is wrong with my motherboard or USB switch or USB connections. How can I figure out what causes the chime? Is there a log somewhere that tracks what causes that sound? So now I've enabled the audit, and I'll see what it reveals.
    – Ryan
    Apr 2 at 16:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .