none
Device connection / disconnection auditing

    Question

  • Is there a way to record in the event logs when a device is connected or disconnected? I've looked under Local Security Policy, but I can't see anything that seems as if it would do the job.

    The reason I ask is that approximately every hour I hear the system sound indicating that a device has been removed, yet nothing has been.
    Wednesday, November 11, 2009 3:19 PM

Answers

  • Why not looking at the setupapi.dev.log file in the folder: C:\Windows\inf?

    Regarding your issue, this kind of behavior may be caused by unstable power supply. If you connect mutiple devices to your computer, try to disconnect some unnessary devices and see if the issue persists.

    Best Regards
    Dale

    Monday, November 16, 2009 7:34 AM

All replies

  • Why not looking at the setupapi.dev.log file in the folder: C:\Windows\inf?

    Regarding your issue, this kind of behavior may be caused by unstable power supply. If you connect mutiple devices to your computer, try to disconnect some unnessary devices and see if the issue persists.

    Best Regards
    Dale

    Monday, November 16, 2009 7:34 AM
  • We have a similar problem with Win7 x86.
    I discovered the issue in usb device.
    Follow the logs, can you help?

    >>>  [Device Install (Hardware initiated) - USB\VID_0000&PID_0000\5&18d9d83e&0&4]
    >>>  Section start 2009/11/25 00:44:12.588
         ump: Creating Install Process: DrvInst.exe 00:44:12.596
         ndv: Retrieving device info...
         ndv: Setting device parameters...
         ndv: Searching just Driver Store...
         dvi: {Build Driver List} 00:44:12.693
         dvi:      Searching for hardware ID(s):
         dvi:           usb\unknown
         dvi:      Searching for compatible ID(s):
         dvi:           usb\unknown
         cpy:      Policy is set to make all digital signatures equal.
         dvi:      Enumerating INFs from path list 'C:\Windows\INF'
         inf:      Opened PNF: 'C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         dvi:      Created Driver Node:
         dvi:           HardwareID   - USB\UNKNOWN
         dvi:           InfName      - C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf
         dvi:           DevDesc      - Unknown Device
         dvi:           DrvDesc      - Unknown Device
         dvi:           Provider     - Microsoft
         dvi:           Mfg          - (Standard USB Host Controller)
         dvi:           ModelsSec    - Generic.Section.NTx86
         dvi:           InstallSec   - BADDEVICE.Dev
         dvi:           ActualSec    - BADDEVICE.Dev.NT
         dvi:           Rank         - 0x00ff0000
         dvi:           Signer       - Microsoft Windows
         dvi:           Signer Score - INBOX
         dvi:           DrvDate      - 06/21/2006
         dvi:           Version      - 6.1.7600.16385
         inf:      Searched 1 potential matches in published INF directory
         inf:      Searched 35 INFs in directory: 'C:\Windows\INF'
         dvi: {Build Driver List - exit(0x00000000)} 00:44:12.853
         ndv: Selecting best match from just Driver Store...
         dvi: {DIF_SELECTBESTCOMPATDRV} 00:44:12.856
         dvi:      No class installer for 'Universal Serial Bus controllers'
         dvi:      No CoInstallers found
         dvi:      Default installer: Enter 00:44:12.862
         dvi:           {Select Best Driver}
         dvi:                Selected driver installs from section [BADDEVICE.Dev] in 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf'.
         dvi:                Class GUID of device changed to: {36fc9e60-c465-11cf-8056-444553540000}.
         dvi:                Set selected driver complete.
         dvi:                Selected:
         dvi:                     Description - [Unknown Device]
         dvi:                     InfFile     - [c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf]
         dvi:                     Section     - [BADDEVICE.Dev]
         dvi:                     Signer      - [Microsoft Windows]
         dvi:                     Rank        - [0x00ff0000]
         dvi:           {Select Best Driver - exit(0x00000000)}
         dvi:      Default installer: Exit
         dvi: {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 00:44:12.884
         inf: Opened PNF: 'C:\Windows\INF\usb.inf' ([strings.0409])
         ndv: INF specified BasicDriverOk for this device, skipping Windows Update search.
         inf: {SetupCopyOEMInf: C:\Windows\INF\usb.inf} 00:44:12.890
         inf:      Driver Store location: C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf
         inf:      Published Inf Path: C:\Windows\INF\usb.inf
         inf: {SetupCopyOEMInf exit (0x00000050)} 00:44:12.895
         dvi: Searching for hardware ID(s):
         dvi:      usb\unknown
         dvi: Searching for compatible ID(s):
         dvi:      usb\unknown
         inf: Opened PNF: 'C:\Windows\System32\DriverStore\FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         dvi: Selected driver installs from section [BADDEVICE.Dev] in 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf'.
         dvi: Class GUID of device changed to: {36fc9e60-c465-11cf-8056-444553540000}.
         dvi: Set selected driver complete.
         ndv: Driver selected, now performing install...
         ndv: {Core Device Install} 00:44:12.915
         inf:      Opened PNF: 'C:\Windows\INF\usb.inf' ([strings.0409])
         inf:      Opened PNF: 'C:\Windows\INF\usb.inf' ([strings.0409])
         dvi:      {DIF_ALLOW_INSTALL} 00:44:12.934
         dvi:           No class installer for 'Unknown Device'
         dvi:           No CoInstallers found
         dvi:           Default installer: Enter 00:44:12.939
         dvi:           Default installer: Exit
         dvi:      {DIF_ALLOW_INSTALL - exit(0xe000020e)} 00:44:12.943
         ndv:      Installing files...
         dvi:      {DIF_INSTALLDEVICEFILES} 00:44:12.947
         dvi:           No class installer for 'Unknown Device'
         dvi:           Default installer: Enter 00:44:12.950
         dvi:                {Install FILES}
         inf:                     Opened PNF: 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT]}
         inf:                          CopyFiles=BADDEVICE.CopyFiles  (usb.inf line 93)
    !    inf:                          Empty Section! [BADDEVICE.CopyFiles]
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT] exit (0x00000000)}
         dvi:                     Processing co-installer registration section [BADDEVICE.Dev.NT.CoInstallers].
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.CoInstallers]}
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.CoInstallers] exit (0x00000000)}
         dvi:                     Co-installers registered.
         dvi:                     {Install INTERFACES}
         dvi:                          Installing section [BADDEVICE.Dev.NT.Interfaces]
         dvi:                     {Install INTERFACES exit 00000000}
         dvi:                {Install FILES exit (0x00000000)}
         dvi:           Default installer: Exit
         dvi:      {DIF_INSTALLDEVICEFILES - exit(0x00000000)} 00:44:12.978
         ndv:      Pruning file queue...
         dvi:      {_SCAN_FILE_QUEUE}
         flq:           ScanQ flags=620
         flq:                SPQ_SCAN_PRUNE_COPY_QUEUE
         flq:                SPQ_SCAN_FILE_COMPARISON
         flq:                SPQ_SCAN_ACTIVATE_DRP
         flq:           ScanQ number of copy nodes=0
         flq:           ScanQ action=200 DoPruning=32
         flq:           ScanQ end Validity flags=620 CopyNodes=0
         dvi:      {_SCAN_FILE_QUEUE exit(0, 0x00000000)}
         ndv:      Committing file queue...
         flq:      {_commit_file_queue}
         flq:           CommitQ DelNodes=0 RenNodes=0 CopyNodes=0
         flq:           CommitQ early exit: No nodes are queued
         flq:      {_commit_file_queue exit OK}
         ndv:      Registering CoInstallers...
         dvi:      {DIF_REGISTER_COINSTALLERS} 00:44:13.008
         dvi:           No class installer for 'Unknown Device'
         dvi:           Default installer: Enter 00:44:13.013
         inf:                Opened PNF: 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         inf:                {Install Inf Section [BADDEVICE.Dev.NT.CoInstallers]}
         inf:                {Install Inf Section [BADDEVICE.Dev.NT.CoInstallers] exit (0x00000000)}
         dvi:                Co-installers registered.
         dvi:           Default installer: Exit
         dvi:      {DIF_REGISTER_COINSTALLERS - exit(0x00000000)} 00:44:13.025
         ndv:      Installing interfaces...
         dvi:      {DIF_INSTALLINTERFACES} 00:44:13.029
         dvi:           No class installer for 'Unknown Device'
         dvi:           No CoInstallers found
         dvi:           Default installer: Enter 00:44:13.035
         dvi:                {Install INTERFACES}
         inf:                     Opened PNF: 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         dvi:                     Installing section [BADDEVICE.Dev.NT.Interfaces]
         dvi:                {Install INTERFACES exit 00000000}
         dvi:           Default installer: Exit
         dvi:      {DIF_INSTALLINTERFACES - exit(0x00000000)} 00:44:13.045
         ndv:      Installing device...
         dvi:      {DIF_INSTALLDEVICE} 00:44:13.048
         dvi:           No class installer for 'Unknown Device'
         dvi:           Default installer: Enter 00:44:13.052
         dvi:                {Install DEVICE}
         inf:                     Opened PNF: 'c:\windows\system32\driverstore\filerepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf' ([strings.0409])
         dvi:                     Processing Registry/Property directives...
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT]}
         inf:                          AddReg=BADDEVICE.AddReg  (usb.inf line 92)
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT] exit (0x00000000)}
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.Hw]}
         inf:                          Empty section
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.Hw] exit (0x00000000)}
         dvi:                     {Writing Device Properties}
         dvi:                          Provider name=Microsoft
         dvi:                          DriverDate 06/21/2006
         dvi:                          DriverVersion=6.1.7600.16385
         dvi:                          Class name=USB
         dvi:                          Manufacturer=(Standard USB Host Controller)
         dvi:                          Matching DeviceID=usb\unknown
         dvi:                          Strong Name=usb.inf:Generic.Section.NTx86:BADDEVICE.Dev:6.1.7600.16385:usb\unknown
         dvi:                     {Writing Device Properties - Complete}
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.Services]}
         inf:                          AddService=,0x00000002  (usb.inf line 100)
    !    dvi:                          Add Service: NULL Controlling service.
         inf:                     {Install Inf Section [BADDEVICE.Dev.NT.Services] exit(0x00000000)}
         dvi:                     Updated reflected section names for: usb.inf
         dvi:                {Install DEVICE exit (0x00000000)}
         dvi:                Writing common driver property settings.
         dvi:                     DriverDescription=Unknown Device
         dvi:                     DeviceDisplayName=Unknown Device
         dvi:                Install Device: Restarting device. 00:44:13.115
         dvi:                Install Device: Restarting device completed. 00:44:13.188
    !!!  dvi:                Device not started: Device has problem: 0x2b: CM_PROB_FAILED_POST_START.
         dvi:           Default installer: Exit
         dvi:      {DIF_INSTALLDEVICE - exit(0x00000000)} 00:44:13.199
         dvi:      {DIF_NEWDEVICEWIZARD_FINISHINSTALL} 00:44:13.202
         dvi:           No class installer for 'Unknown Device'
         dvi:           Default installer: Enter 00:44:13.208
         dvi:           Default installer: Exit
         dvi:      {DIF_NEWDEVICEWIZARD_FINISHINSTALL - exit(0xe000020e)} 00:44:13.213
         ndv:      Device install status=0x00000000
         ndv:      Performing device install final cleanup...
    !    ndv:      Queueing up error report since device has a PnP problem...
         ndv: {Core Device Install - exit(0x00000000)} 00:44:13.223
         ump: Server install process exited with code 0x00000000 00:44:13.243
    <<<  Section end 2009/11/25 00:44:13.248
    <<<  [Exit status: SUCCESS]


    Log Name:      System
    Source:        Microsoft-Windows-UserPnp
    Date:          2009.11.25. 0:44:13
    Event ID:      20001
    Task Category: (7005)
    Level:         Information
    Keywords:     
    User:          SYSTEM
    Computer:      Mono7
    Description:
    Driver Management concluded the process to install driver FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf for Device Instance ID USB\VID_0000&PID_0000\5&18D9D83E&0&4 with the following status: 0x0.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-UserPnp" Guid="{96F4A050-7E31-453C-88BE-9634F4E02139}" />
        <EventID>20001</EventID>
        <Version>0</Version>
        <Level>4</Level>
        <Task>7005</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2009-11-24T23:44:13.220703100Z" />
        <EventRecordID>3169</EventRecordID>
        <Correlation />
        <Execution ProcessID="3892" ThreadID="3284" />
        <Channel>System</Channel>
        <Computer>Mono7</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <InstallDeviceID xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/userpnp">
          <DriverName>FileRepository\usb.inf_x86_neutral_e24d8d3fec6e4567\usb.inf</DriverName>
          <DriverVersion>6.1.7600.16385</DriverVersion>
          <DriverProvider>Microsoft</DriverProvider>
          <DeviceInstanceID>USB\VID_0000&amp;PID_0000\5&amp;18D9D83E&amp;0&amp;4</DeviceInstanceID>
          <SetupClass>{36FC9E60-C465-11CF-8056-444553540000}</SetupClass>
          <RebootOption>false</RebootOption>
          <UpgradeDevice>false</UpgradeDevice>
          <IsDriverOEM>false</IsDriverOEM>
          <InstallStatus>0x0</InstallStatus>
          <DriverDescription>Unknown Device</DriverDescription>
        </InstallDeviceID>
      </UserData>
    </Event>

    Wednesday, November 25, 2009 12:02 AM
  • I have found the issue: it's the power of a USB external TV card. So the card doesn't turn on correctly, or sometimes it disappears like it was turned off.
    ANYWAY I wouldlike to know how to troubleshoot these kind of issues. The setupapi.dev.log contains only info when a driver is installed, if the driver is already installed and one device is plugged in or removed, there is no entry in the log file.

    THANKS! Alex
    Wednesday, November 25, 2009 9:56 PM
  • Thanks for the suggestion of looking at the logs, but as has been said, if the driver is already installed there is no entry in the file. However, as I didn't know about the log file directory, that has been noted for future reference.

    I was about to unplug half the usb devices, wait for a few hours to see if the problem appeared, etc etc etc, when purely by chance I found a dodgy connection in a usb to serial link.

    Regards,

    John
    Sunday, December 13, 2009 9:02 PM