How to track/log device disconnect events

Try the solution they provided before linking to the third party app. The third party app was a suggestion along the lines of "If this doesn't do it for you, try installing this app, which does have this functionality built-in."

Anyways...
What worked for me was their initial suggestion. I'll write it here in my words:

1. Open Event Viewer
2. On the left panel, all the way at the top, click on "Event Viewer (Local)"
3. In the main/center panel, look under the section titled "Summary of Administrative Events"
4. Click on "Information" (no need to click the +, just click on "Information")
5. On the right panel, click on "View All Instances of This Event"

In my case, I was then able to filter the provided list of events by the Source = "DeviceSetupManager". Each of these events under that source occurs when a device is connected/disconnected.

The details of the event should show the device name/hardware ID.
It's up to you at that point to identify which device that is and why it's here.

BTW,

I found you can check the events at "Microsoft-Windows-Kernel-PnP/Device Management" log and get the hardware ID.

HTH

Marcelo

Open powershell.

See if you're even recording those events to begin with using "auditpol /get /category:*".

You're looking under the "Detailed Tracking" category for "Plug and Play Events".

If it's "No Auditing" then you'll have to enable that first. (Sorry I'm not sure how to do that as I'm a read-only level IT guy for now). In my setup it's a Group Policy thing so I think that's the "gpedit" program.

If it's "Success" though, then I think these are the Event IDs you'll wanna search in the "Security" section of "Windows Logs" within Event Viewer.

• EDIT: 2102 might be the most relevant I have no idea tho.
• 6416(S): A new external device was recognized by the System.
• 6419(S): A request was made to disable a device.
• 6420(S): A device was disabled.
• 6421(S): A request was made to enable a device.
• 6422(S): A device was enabled.
• 6423(S): The installation of this device is forbidden by system policy.
• 6424(S): The installation of this device was allowed, after having previously been forbidden by policy.

Hope that helps. I'm utterly shocked at how unhelpful every other answer is.

I don't get it. The solution is to go to a webpage and click download.

At that point it demands I install an "advanced search" extension to chrome.

I don't want to but I am motivated so I add it to chrome

It tells me it was added and detected by the download page.

No program gets downloaded.

How does that solve anything?

Is this an actual attempt to solve the issue or just a scam for "advanced search"?

Hi ,

Sabya here, Independent Windows Adviser. Hope you are doing well.

You can open event viewer and then click on the event viewer (local) on the left side

You will see a summary of administrative events. Click on information (no need to expand)

In the right pane you will see view all instances of this event

Click on it and then try to find the time where you had the issue.

There is a third party application called Nirsoft which you can use to record the usb device being plugged in or unplugged.

http://www.nirsoft.net/utils/usb_log_view.html

This is a public user-to-user support forum. I'm a user like you helping other users. I do not work for Microsoft and cannot access any user accounts.

________________________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before downloading and installing it.