0

How can I get timestamps on previously connected External devices for a specific port? (Usage Start Time and Usage End time)

I have tried this but, i am only getting USB list, I need all the external devices are connected History on a specific port

Get-WinEvent -LogName 'Microsoft-Windows-DriverFrameworks-UserMode/Operational' |Where-Object {$_.ID -eq 2003 -or $_.ID -eq 2102} | Select-Object @{Name='TimeCreated';Expression={$_.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss')}}, ID, LogName, MachineName, Message, Opcode, OpcodeDisplayName, ProviderId, ProviderName, RecordId, Task, TaskDisplayName|ConvertTo-Json
mklement0
  • 382,024
  • 64
  • 607
  • 775
bharath k
  • 1
  • Have you connected any other types of external devices since the earliest event in the log? Perhaps you'll want to configure the event log channel to have a bigger file size... – Mathias R. Jessen Jul 27 '23 at 19:07
  • Yes I have connect 1 Monitor to the laptop, but it is not under 2003 and 2102 event id's I want to track any kind of external devices that are connecting to laptop need to find it. – bharath k Jul 27 '23 at 19:33
  • You probably want `Get-EventLog -LogName Security -InstanceId 6416` that fires whenever any external device is connected. – TheMadTechnician Jul 27 '23 at 22:27
  • Thanks You, Yes, I have seen this scenario also, but how we will find the Disconnect time form a particular port. – bharath k Jul 28 '23 at 18:23

0 Answers0