?
Solved

XP and USB Devices - is there a system event log?

Posted on 2010-09-15
10
Medium Priority
?
2,355 Views
Last Modified: 2012-05-10
We have a LAN based system within a WAN using bespoke software with a Sentinel type USB dongle to authenticate the installation.  

Today it's missing, presumably someone is going to be disappointed with their newly acquired USB memory stick!

Now I can trace when the software last authenticated a user but as the XP machine that acts as the host "server" is always on will there be a timed record within Windows of when the device was removed? (There are no other USB devices that would be connected or removed duing the same period).

0
Comment
Question by:☠ MASQ ☠
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
  • 2
10 Comments
 
LVL 20

Accepted Solution

by:
woolnoir earned 2000 total points
ID: 33681146
I dont believe XP logs the removal of USB devices. Just tested an XP machine here with a usb stick and nothing.
0
 
LVL 20

Expert Comment

by:woolnoir
ID: 33681160
although - http://thepcsecurity.com/usbdeview-usb-event-log-file-to-remember-usb-device-connections/ this software claims to be able to determine times, so give it a try.
0
 
LVL 11

Expert Comment

by:farjadarshad
ID: 33681215
yes in event viewer move on to system here check all event with eventid= 7035 and source= system . Now one of the event contain following message

"The Universal Plug and Play Device Host service was successfully sent a start control".

note the above event's date and time. Hope this will help you


0
Ransomware Attacks Keeping You Up at Night?

Will your organization be ransomware's next victim?  The good news is that these attacks are predicable and therefore preventable. Learn more about how you can  stop a ransomware attacks before encryption takes place with our Ransomware Prevention Kit!

 
LVL 63

Author Comment

by:☠ MASQ ☠
ID: 33683791
Tried event viewer but there are no instances of USB device plug/unplugs recorded.
Tried with a USB memory stick and it wasn't recorded :(

Will check the link but suspect it may be a service that needs to be present ahead of the event.
0
 
LVL 63

Author Comment

by:☠ MASQ ☠
ID: 33685729
Am trying http://www.nirsoft.net/utils/usb_devices_view.html
Which although not logging every use logs the most recent changes - will let you know how it goes but if there are any other ideas ....
0
 
LVL 20

Expert Comment

by:woolnoir
ID: 33685770
yeah i tried it myself earlier (the one i suggested above ) and it didnt pick anything up, and since there is nothing in my event log for USB drive addition/removal that makes sense.
0
 
LVL 11

Expert Comment

by:farjadarshad
ID: 33688411
But i have tested the USB event, personally on my system, which i have already mentioned above. i would suggest you to search all the system events with event id = 7035 and 7036. I hope any of them contains the following information.

"The Universal Plug and Play Device Host service was successfully sent a start control".

Hope you will get your desired result
0
 
LVL 63

Author Comment

by:☠ MASQ ☠
ID: 33690861
No, have done this and although there are 7035 and 7036 start and stop messages no USB devices are recorded in the log.  They all refer to network services.
 
The utility I linked to certainly records all the USB devices that have been plugged grabbing from both Registry and Device Manger but although some plug/unplug dates are recorded it's not consistent and misses the Key I'm interested in (but it's UUID is displayed together with date first installed).
I now don't think Event Manager handles this natively in XP much as woolnoir states in their first post.
0
 
LVL 20

Assisted Solution

by:woolnoir
woolnoir earned 2000 total points
ID: 33691894
The interesting thing about farjadarshad's post is that it mentions Universal Plug and Play Device Host which is UPnP - strictly speaking this is nothing to do with traditional PnP i.e hot plugging devices, i don't know why it would show an event for a USB key insertion/removal - that being said 7035 and 7036 do match device removal.

I've had a chat with a few colleagues or mine and they have both said Vista was the first OS which this could be tracked natively - it got added in line with some new USB GPO control for USB devices.
0
 
LVL 63

Author Comment

by:☠ MASQ ☠
ID: 33803027
As posted this isn't available on XP and was introduced as a service in Vista.  There are tools that will collate data based on system logs and device manager but they are far from 100% acurate.
0

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Monitor input from a computer is usually nothing special.  In this instance it prevented anyone from using the computer.  This was a preconfiguration that didn't work.
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question