0

Overview

I want to be able to uniquely identify when a particular Android device connects and/or disconnects from my Windows 10 PC. I run different scripts based on the particular device and whether it just connected or disconnected. I do not always connect to the same USB port.


Connection

I Can Detect & Identify Device: I detect the USB connection of my Android Mobile Devices using Windows Event ID 2101 (Microsoft-Windows-DriverFrameworks-UserMode). This event also uniquely identify the device using an "InstanceId" that is tied to the device and that Windows reuses for subsequent connections (sample event at bottom).


Disconnection

I Can Detect, but Not Identify Device: I can currently detect the USB disconnection of my Android Mobile Devices using Windows Event ID 1002 (Microsoft-Windows-WPD-MTPClassDriver/). The event is common for all my devices and does not allow me to identify the specific device.

I'm looking for an Event (or a combination of events) that detects the USB disconnection and also provides a way to identify the specific device.

Workaround

My current approach involves using Event ID 1002 ("some device disconnected")as a trigger and then parsing the output from 'ADB Devices' to determine which device(s) just disconnected. In order for that to work I need to maintain a list of devices I "think" are connected and then compare it to a list of connected devices and see if any are missing.


Sample Windows Events Below (XML)

1. Connection Event ID 2101 - Phone A
2. Connection Event ID 2101 - Phone B
3. Disconnect Event ID 1002 - All Phones

1. Sample Connection Event ID 2101 - Phone A
(InstanceID: USB\VID_2A70&PID_9011&MI_00\6&1A318017&0&0000)

Log Name:      Microsoft-Windows-DriverFrameworks-UserMode/Operational
Source:        Microsoft-Windows-DriverFrameworks-UserMode
Date:          5/10/21 6:27:00 PM
Event ID:      2101
Task Category: Pnp or Power Management operation to a particular device.
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      Basement-PC
Description:
Completed a Pnp or Power operation (27, 9) for device USB\VID_2A70&PID_9011&MI_00\6&1A318017&0&0000 with status 0x0.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2e35aaeb-857f-4beb-a418-2e6c0e54d988}" />
    <EventID>2101</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>37</Task>
    <Opcode>2</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-05-10T22:27:00.8437243Z" />
    <EventRecordID>6543</EventRecordID>
    <Correlation />
    <Execution ProcessID="23780" ThreadID="15944" />
    <Channel>Microsoft-Windows-DriverFrameworks-UserMode/Operational</Channel>
    <Computer>Basement-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <UserData>
    <UMDFHostDeviceRequest xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
      <LifetimeId>{b9189c1f-df04-44cb-90f4-89a7fa99f64e}</LifetimeId>
      <InstanceId>USB\VID_2A70&amp;PID_9011&amp;MI_00\6&amp;1A318017&amp;0&amp;0000</InstanceId>
      <RequestMajorCode>27</RequestMajorCode>
      <RequestMinorCode>9</RequestMinorCode>
      <Argument1>0x60000010040</Argument1>
      <Argument2>0xffffffff00000004</Argument2>
      <Argument3>0x100000000</Argument3>
      <Argument4>0x300000003</Argument4>
      <Status>0</Status>
    </UMDFHostDeviceRequest>
  </UserData>
</Event>

2. Sample Connection Event ID 2101 - Phone B
(InstanceId: USB\VID_2A70&PID_9012&MI_00\6&BC66942&0&0000)

Log Name:      Microsoft-Windows-DriverFrameworks-UserMode/Operational
Source:        Microsoft-Windows-DriverFrameworks-UserMode
Date:          5/03/21 6:48:15 PM
Event ID:      2101
Task Category: Pnp or Power Management operation to a particular device.
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      Basement-PC
Description:
Completed a Pnp or Power operation (27, 20) for device USB\VID_2A70&PID_9012&MI_00\6&BC66942&0&0000 with status 0x0.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2e35aaeb-857f-4beb-a418-2e6c0e54d988}" />
    <EventID>2101</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>37</Task>
    <Opcode>2</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-05-03T22:48:15.2504167Z" />
    <EventRecordID>4430</EventRecordID>
    <Correlation />
    <Execution ProcessID="22852" ThreadID="31540" />
    <Channel>Microsoft-Windows-DriverFrameworks-UserMode/Operational</Channel>
    <Computer>Basement-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <UserData>
    <UMDFHostDeviceRequest xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
      <LifetimeId>{22a36779-2f19-4e04-a1df-e5a24951ca7e}</LifetimeId>
      <InstanceId>USB\VID_2A70&amp;PID_9012&amp;MI_00\6&amp;BC66942&amp;0&amp;0000</InstanceId>
      <RequestMajorCode>27</RequestMajorCode>
      <RequestMinorCode>20</RequestMinorCode>
      <Argument1>0x0</Argument1>
      <Argument2>0x141b</Argument2>
      <Argument3>0x0</Argument3>
      <Argument4>0x0</Argument4>
      <Status>0</Status>
    </UMDFHostDeviceRequest>
  </UserData>
</Event>

3. Sample Disconnect Event ID 1002

Log Name:      Microsoft-Windows-WPD-MTPClassDriver/Operational
Source:        Microsoft-Windows-WPD-MTPClassDriver
Date:          5/11/21 1:43:52 PM
Event ID:      1002
Task Category: Driver Operation
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      Basement-PC
Description:
Device is entering the idle state (Idle state: 4; Return code: 0x0).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WPD-MTPClassDriver" Guid="{21b7c16e-c5af-4a69-a74a-7245481c1b97}" />
    <EventID>1002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>32</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-05-11T17:43:52.2329467Z" />
    <EventRecordID>650</EventRecordID>
    <Correlation />
    <Execution ProcessID="10536" ThreadID="12796" />
    <Channel>Microsoft-Windows-WPD-MTPClassDriver/Operational</Channel>
    <Computer>Basement-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="State">4</Data>
    <Data Name="hr">0</Data>
  </EventData>
</Event>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.