Solved

XP and USB Devices - is there a system event log?

Posted on 2010-09-15
10
2,076 Views
Last Modified: 2012-05-10
We have a LAN based system within a WAN using bespoke software with a Sentinel type USB dongle to authenticate the installation.  

Today it's missing, presumably someone is going to be disappointed with their newly acquired USB memory stick!

Now I can trace when the software last authenticated a user but as the XP machine that acts as the host "server" is always on will there be a timed record within Windows of when the device was removed? (There are no other USB devices that would be connected or removed duing the same period).

0
Comment
Question by:☠ MASQ ☠
  • 4
  • 4
  • 2
10 Comments
 
LVL 20

Accepted Solution

by:
woolnoir earned 500 total points
Comment Utility
I dont believe XP logs the removal of USB devices. Just tested an XP machine here with a usb stick and nothing.
0
 
LVL 20

Expert Comment

by:woolnoir
Comment Utility
although - http://thepcsecurity.com/usbdeview-usb-event-log-file-to-remember-usb-device-connections/ this software claims to be able to determine times, so give it a try.
0
 
LVL 11

Expert Comment

by:farjadarshad
Comment Utility
yes in event viewer move on to system here check all event with eventid= 7035 and source= system . Now one of the event contain following message

"The Universal Plug and Play Device Host service was successfully sent a start control".

note the above event's date and time. Hope this will help you


0
 
LVL 62

Author Comment

by:☠ MASQ ☠
Comment Utility
Tried event viewer but there are no instances of USB device plug/unplugs recorded.
Tried with a USB memory stick and it wasn't recorded :(

Will check the link but suspect it may be a service that needs to be present ahead of the event.
0
 
LVL 62

Author Comment

by:☠ MASQ ☠
Comment Utility
Am trying http://www.nirsoft.net/utils/usb_devices_view.html
Which although not logging every use logs the most recent changes - will let you know how it goes but if there are any other ideas ....
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 20

Expert Comment

by:woolnoir
Comment Utility
yeah i tried it myself earlier (the one i suggested above ) and it didnt pick anything up, and since there is nothing in my event log for USB drive addition/removal that makes sense.
0
 
LVL 11

Expert Comment

by:farjadarshad
Comment Utility
But i have tested the USB event, personally on my system, which i have already mentioned above. i would suggest you to search all the system events with event id = 7035 and 7036. I hope any of them contains the following information.

"The Universal Plug and Play Device Host service was successfully sent a start control".

Hope you will get your desired result
0
 
LVL 62

Author Comment

by:☠ MASQ ☠
Comment Utility
No, have done this and although there are 7035 and 7036 start and stop messages no USB devices are recorded in the log.  They all refer to network services.
 
The utility I linked to certainly records all the USB devices that have been plugged grabbing from both Registry and Device Manger but although some plug/unplug dates are recorded it's not consistent and misses the Key I'm interested in (but it's UUID is displayed together with date first installed).
I now don't think Event Manager handles this natively in XP much as woolnoir states in their first post.
0
 
LVL 20

Assisted Solution

by:woolnoir
woolnoir earned 500 total points
Comment Utility
The interesting thing about farjadarshad's post is that it mentions Universal Plug and Play Device Host which is UPnP - strictly speaking this is nothing to do with traditional PnP i.e hot plugging devices, i don't know why it would show an event for a USB key insertion/removal - that being said 7035 and 7036 do match device removal.

I've had a chat with a few colleagues or mine and they have both said Vista was the first OS which this could be tracked natively - it got added in line with some new USB GPO control for USB devices.
0
 
LVL 62

Author Comment

by:☠ MASQ ☠
Comment Utility
As posted this isn't available on XP and was introduced as a service in Vista.  There are tools that will collate data based on system logs and device manager but they are far from 100% acurate.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now