I am currently trying to find a way to log all of the connections and disconnections of USB devices from all of the Windows machines on our network. This information needs to automatically be logged to a file on the machine, this file can then be read by nxlog and then get shipped to our centralised logging platform for processing. I was hoping that this information would be logged by Windows logs automatically, but I found that while some information about USB removable storage appears to get logged to Event Viewer, this is quite limited information and doesn't pick up when USB keyboards and mice are connected and disconnected.
After some digging I found that nirsoft had written a small exe which does a lot of the hard work, USBLogView can be run without installation and logs every time a USB device connects and disconnects to the machine. The issue with this is that I cannot see a way to run this as a service, nor do I see any way to have it automatically log the information it outputs to a log file, although you can select log entries and manually select them to be saved to a log file.
I could use Group Policy to create a local copy of the exe file, and then somehow force this exe to run during startup, but the main issue of not being able to get the logs automatically written to file would still need to be overcome. I would also need to be able to ensure that the user isn't able to close the program, which is possible when I launch it myself, ideally having it hidden and not showing a tray icon would be the best way for it to be set up (but when I have tried using the hidden setting, it seems to me that it can either be shown in the main window, or just displaying the systray icon). I looked on the website, but I don't see any way to invoke the program with options to tell it to do this. I also emailed nirsoft last week to see if they had any advice, but I am still waiting for a response.
Has anyone got any alternative ways to do this at all? Any suggestions or help welcome! Thanks