Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ## Get plug and play device started events & cross reference device id to the registry which stores the friendly name even when device no longer present
- Get-WinEvent -FilterHashtable @{ ProviderName = 'Microsoft-Windows-Kernel-Pnp' ; id = 410 }|select-object -property TimeCreated,@{n='Device';e={$_.Properties[0].value}},@{n='DriverName';e={$_.properties[1].Value}},@{n='DeviceName';e={$_.Properties[0].value}},@{n='ServiceName';e={$_.properties[3].Value}},@{n='FriendlyName';e={Get-ItemProperty "HKLM:\System\CurrentControlSet\Enum\$($_.properties[0].value)" -ea 0|Select -ExpandProperty friendlyname}}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement