10

I am currently trying to find a way to log all of the connections and disconnections of USB devices from all of the Windows machines on our network. This information needs to automatically be logged to a file on the machine, this file can then be read by nxlog and then get shipped to our centralised logging platform for processing. I was hoping that this information would be logged by Windows logs automatically, but I found that while some information about USB removable storage appears to get logged to Event Viewer, this is quite limited information and doesn't pick up when USB keyboards and mice are connected and disconnected.

After some digging I found that nirsoft had written a small exe which does a lot of the hard work, USBLogView can be run without installation and logs every time a USB device connects and disconnects to the machine. The issue with this is that I cannot see a way to run this as a service, nor do I see any way to have it automatically log the information it outputs to a log file, although you can select log entries and manually select them to be saved to a log file.

I could use Group Policy to create a local copy of the exe file, and then somehow force this exe to run during startup, but the main issue of not being able to get the logs automatically written to file would still need to be overcome. I would also need to be able to ensure that the user isn't able to close the program, which is possible when I launch it myself, ideally having it hidden and not showing a tray icon would be the best way for it to be set up (but when I have tried using the hidden setting, it seems to me that it can either be shown in the main window, or just displaying the systray icon). I looked on the website, but I don't see any way to invoke the program with options to tell it to do this. I also emailed nirsoft last week to see if they had any advice, but I am still waiting for a response.

Has anyone got any alternative ways to do this at all? Any suggestions or help welcome! Thanks

2

There are paid solutions for that eg. EndProtection4 by CoSoSys. No idea how that works inside the agent installed on the device but it gives you all information on devices plugged in. You need a server side that manages the clients as this is the software that manages access to devices. Works on Macs and Linux as well.

3

Connecting and disconnecting of USB devices is logged in the "Event Log".

Quoting this detailed description ("Digital Forensics Stream" blog, 2014-01-02, The Windows 7 Event Log and USB Device Tracking):

Connection Event IDs
When a USB removable storage device is connected to a Windows 7 system, a number of event records should be generated in the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. ...

Disconnection Event IDs
When a USB thumb drive is disconnected from a Windows 7 system, a few event records should be generated in the same event log as the connection events. Records with Event ID 2100, 2102, and potentially more may be generated when a USB device is disconnected. ...

For automating exports from the Event Log, Microsoft offers the logparser for free.

  • 2
    Thanks for the reply, but as I said in my question, Event Viewer shows when you connect USB Storage devices, but not USB devices like keyboards etc. I want to collect the information for all USB devices not just USB storage devices. – Rumbles Dec 8 '14 at 18:05
  • @Rumbles Are you sure you're looking at the right log? The log named above is not one of the "usual" ones. On the other hand, the log named above will only contain info on devices handled by UMDF drivers. Not KMDF drivers and not non-framework drivers. – Jamie Hanrahan Jan 28 '16 at 14:51
  • 1
    I cannot confirm, it's something I haven't looked in to in a while, and have since changed jobs and rarely work with Windows desktop machines now (hooray!) – Rumbles Jan 28 '16 at 15:33
  • I was able to see storage devices but not a USB mouse using when enabling this log. – Tyler Szabo Nov 16 '18 at 4:56
0

I would try using a tool such as AutoIT.

$vFile = FileOpen("usb.txt", 2)

Local $vObjWMI = ObjGet("winmgmts:\\" & @ComputerName & "\root\cimv2")

$vObjItems = $vObjWMI.ExecQuery('SELECT * FROM Win32_DiskDrive')
If IsObj($vObjItems) Then
    For $vObjItem In $vObjItems
        If StringInStr($vObjItem.Caption, "USB") Then
            FileWriteLine($vFile, $vObjItem.Caption & @CRLF)
            FileWriteLine($vFile, $vObjItem.DeviceID & @CRLF & @CRLF)
        EndIf
    Next
EndIf

FileClose($vFile)

ShellExecute("usb.txt")

A forum post this came from is on the AutoIT forum is located here: http://www.autoitscript.com/forum/topic/155213-detect-usb-devices-connected/?p=1121434

0

Use regedit and look in the registry items under: HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\. For some details open PowerShell and run:

$Path = 'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*'
Get-ItemProperty -Path $Path | Select-Object -Property FriendlyName, CompatibleIDs, Mfg

Or look in the log file here: C:\Windows\inf\setupapi.dev.log.

For more technical details, look at Nicoles Blog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.