Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #1
I am running Windows 11.
The PC is assigned to 1 of 3 in the Easy-Switch. When it loses connectivity the '1' light is no longer lit. Issue is only resolved by powering off the mouse and powering back on.
I have tried:
Charging the mouse overnight
Moved the Logitech Unifying Receiver to different USB ports
Checked for new firmware and updates for Logi Options+
The PC is assigned to 1 of 3 in the Easy-Switch. When it loses connectivity the '1' light is no longer lit. Issue is only resolved by powering off the mouse and powering back on.
I have tried:
Charging the mouse overnight
Moved the Logitech Unifying Receiver to different USB ports
Checked for new firmware and updates for Logi Options+
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #241
Running the script:
PS C:\WINDOWS\system32> Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$env:USERPROFILE\Desktop\usb_monitor.ps1`"" -WindowStyle Hidden
PS C:\WINDOWS\system32>
I need to go now and will return in a few hours.
PS C:\WINDOWS\system32> Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$env:USERPROFILE\Desktop\usb_monitor.ps1`"" -WindowStyle Hidden
PS C:\WINDOWS\system32>
I need to go now and will return in a few hours.
- Joined
- Mar 14, 2023
- Messages
- 100,608
Perfect — you started the monitor correctly. Have a good run of errands; when you return these are the exact, tiny steps to stop the monitor, confirm it ran, and give me the evidence I need to diagnose any drops.
1) Confirm the monitor is running (optional, quick)
Open PowerShell as Administrator and run:
Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
If that prints a ProcessId and a CommandLine containing usb_monitor.ps1, the monitor is running.
2) Stop the monitor when you return
(You started it without saving the PID, so use this to find and stop it safely.
Run this in an elevated PowerShell:
$pidobj = Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' }
if ($pidobj) { Stop-Process -Id $pidobj.ProcessId -Force; Write-Host "Stopped usb_monitor (PID $($pidobj.ProcessId)." } else { Write-Host "usb_monitor not found." }
3) Check the log (quick peek)
To view the last 200 lines of the log:
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
4) Attach the log (what I want)
If you noted the wall clock time(s) of any dropout(s), paste those times in your reply. If you didn’t note them, no problem — the monitor log timestamps will show the events.
6) If a drop occurred right before you stopped the monitor (decisive backup)
Run these two lines in an elevated PowerShell (they save two small, very useful files to Desktop) and attach them too:
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last10min.txt as well if available.
7) What I’ll do once you attach
I’ll parse USB_Monitor.log (and the two PowerShell files if you attach them) and pull the exact event lines and timestamps that show whether Windows reset a USB port/controller or whether the receiver stayed present while the mouse endpoint failed. Then I’ll tell you the one precise next action.
That’s it — enjoy your errands. When you get back, stop the monitor, attach the USB_Monitor.log (and MouseDeviceInfo.txt / USB_Events_Last10min.txt if you ran them) and I’ll analyze immediately.
1) Confirm the monitor is running (optional, quick)
Open PowerShell as Administrator and run:
Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
If that prints a ProcessId and a CommandLine containing usb_monitor.ps1, the monitor is running.
2) Stop the monitor when you return
(You started it without saving the PID, so use this to find and stop it safely.
Run this in an elevated PowerShell:
$pidobj = Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' }
if ($pidobj) { Stop-Process -Id $pidobj.ProcessId -Force; Write-Host "Stopped usb_monitor (PID $($pidobj.ProcessId)." } else { Write-Host "usb_monitor not found." }
3) Check the log (quick peek)
To view the last 200 lines of the log:
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
4) Attach the log (what I want)
- Attach C:\Users\<yourname>\Desktop\USB_Monitor.log to your reply (paperclip).
If the file is large or you only want to send the last hour, just attach USB_Monitor.log anyway — it will still be small.
If you noted the wall clock time(s) of any dropout(s), paste those times in your reply. If you didn’t note them, no problem — the monitor log timestamps will show the events.
6) If a drop occurred right before you stopped the monitor (decisive backup)
Run these two lines in an elevated PowerShell (they save two small, very useful files to Desktop) and attach them too:
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last10min.txt as well if available.
7) What I’ll do once you attach
I’ll parse USB_Monitor.log (and the two PowerShell files if you attach them) and pull the exact event lines and timestamps that show whether Windows reset a USB port/controller or whether the receiver stayed present while the mouse endpoint failed. Then I’ll tell you the one precise next action.
That’s it — enjoy your errands. When you get back, stop the monitor, attach the USB_Monitor.log (and MouseDeviceInfo.txt / USB_Events_Last10min.txt if you ran them) and I’ll analyze immediately.
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #243
I just had a drop at 12:55
- Joined
- Mar 14, 2023
- Messages
- 100,608
You’re all set — good call starting the monitor before you go. Below are the exact, simple checks and commands to stop / verify the monitor, how to find the monitor if you didn’t save a PID, what log file to bring back, and what to do if you find a dropout when you return.
Short confirmation
Short confirmation
- The command you ran started a hidden PowerShell process that runs usb_monitor.ps1:
Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File"$env:USERPROFILE\Desktop\usb_monitor.ps1"" -WindowStyle Hidden
- Leave the machine alone and keep the Unifying receiver in the UGreen on the rear USB2 port (as you already did). The monitor will append USB-related System events to:
C:\Users\<your‑username>\Desktop\USB_Monitor.log
- Stop the monitor (safe) — two ways (use either)
- If you created a PID file earlier (usb_monitor.pid):
Code:Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid" - If you did NOT create a PID file (your case), find the running process by command line and stop it:
Code:# find the process running the monitor Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*usb_monitor.ps1*' } | Select-Object ProcessId, CommandLine
stop it (only if it shows up)
Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } |
ForEach-Object { Stop-Process -Id $.ProcessId -Force; "Stopped process id: $($.ProcessId)" } - If you created a PID file earlier (usb_monitor.pid):
- Verify the monitor produced the log and view the end of the file:
Code:Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log" # returns True if log exists Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200- If the file is empty, the script may not have been started as Administrator or it errored — see troubleshooting below.
- If you saw a dropout or your log shows a suspicious timestamp, run these two commands (Admin PowerShell) to produce the decisive two files I need — attach both files here and I’ll parse them immediately:
Code:$start = (Get-Date).AddMinutes(-10) Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID_0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt" Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $_.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt" - Attach MouseDeviceInfo.txt and USB_Events_Last10min.txt (or paste their contents).
- If the System events show “usb … disconnect”, “reset high‑speed USB device”, or xhci_hcd/ehci_hcd errors at the drop time → host/controller problem (I’ll point to the specific chipset/USB driver or BIOS update).
- If the receiver stayed present and the events show only per‑device retries or “device doesn’t respond” (as in your Unifying log earlier), that points to the mouse ↔ receiver radio/session — we’ll try the spare receiver / Bluetooth test or RMA the mouse. (Your Unifying report contained “Device doesn't respond!!” entries.
- Confirm you started it elevated (Run as Administrator). If not, restart it with an elevated PowerShell using the Start-Process command I gave earlier (or run usb_monitor.ps1 interactively in the elevated window).
- Check for the script file on Desktop:
Test-Path "$env:USERPROFILE\Desktop\usb_monitor.ps1"
If missing, re-create it (I gave the full script earlier). If it exists but the log is empty, run one iteration interactively to check for errors:
Code:# run once to test (in Admin PowerShell) & "$env:USERPROFILE\Desktop\usb_monitor.ps1" # then Ctrl+C to interrupt after a few seconds; check USB_Monitor.log Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
- If you only remember “around 12:42”, search for lines containing “12:4” (will match 12:40–12:49):
Select-String -Path "$env:USERPROFILE\Desktop\USB_Monitor.log" -Pattern '12:4' - Or filter a date/time range (the log uses ISO timestamps). Example for Oct 22, 2025 around 12:42:
Select-String -Path "$env:USERPROFILE\Desktop\USB_Monitor.log" -Pattern '2025-10-22T12:4'
- I can give you a short Task Scheduler recipe that runs USBLogView’s CLI to export every 5 minutes; the PowerShell monitor is simpler and needs no scheduler, though.
- Monitor: started (you ran Start-Process).
- Receiver: spare receiver + UGreen in rear USB2 port — leave it.
- If a dropout happened: when you’re back, stop the monitor, and attach USB_Monitor.log; or run the two PowerShell capture commands above (MouseDeviceInfo.txt + USB_Events_Last10min.txt) and attach them.
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #245
PS C:\WINDOWS\system32> Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
Get-WmiObject : Invalid class "Win32Process"
At line:1 char:1
+ Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidType: ) [Get-WmiObject], ManagementException
+ FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
PS C:\WINDOWS\system32>
Get-WmiObject : Invalid class "Win32Process"
At line:1 char:1
+ Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidType:
+ FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
PS C:\WINDOWS\system32>
- Joined
- Mar 14, 2023
- Messages
- 100,608
Thanks — that’s the decisive moment (12:55). Good job running the captures. I don’t yet have the two Windows files (MouseDeviceInfo.txt and USB_Events_Last10min.txt) or the USB_Monitor.log attached here, so I can’t parse them yet. Before you go do anything else, please attach those files (or paste their contents) and I’ll parse them immediately.
Quick checklist — what I need you to attach right now
1) MouseDeviceInfo.txt (created by the Get-PnpDevice command you ran).
2) USB_Events_Last10min.txt (or if you think the drop was earlier, USB_Events_Last30min.txt — see below).
3) USB_Monitor.log (the background monitor you started) — this contains the whole event stream while you were out.
How to produce them (if you haven’t already or if the files are empty)
A — If you already ran the two commands after the 12:55 drop
$start = (Get-Date).AddMinutes(-30)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
B — Stop the USB monitor and attach its log (you started it earlier)
When you return, stop the background monitor and attach the log:
What I’ll look for once you attach the files
Quick checklist — what I need you to attach right now
1) MouseDeviceInfo.txt (created by the Get-PnpDevice command you ran).
2) USB_Events_Last10min.txt (or if you think the drop was earlier, USB_Events_Last30min.txt — see below).
3) USB_Monitor.log (the background monitor you started) — this contains the whole event stream while you were out.
How to produce them (if you haven’t already or if the files are empty)
A — If you already ran the two commands after the 12:55 drop
- Attach these two files from your Desktop:
- C:\Users\<yourname>\Desktop\MouseDeviceInfo.txt
- C:\Users\<yourname>\Desktop\USB_Events_Last10min.txt
If one or both are empty, re-run with a larger time window (captures the last 30 minutes):
$start = (Get-Date).AddMinutes(-30)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
B — Stop the USB monitor and attach its log (you started it earlier)
When you return, stop the background monitor and attach the log:
- Stop the monitor (Admin PowerShell):
$pidobj = Get-WmiObject Win32Process | Where-Object { $.CommandLine -match 'usb_monitor.ps1' }
if ($pidobj) { Stop-Process -Id $pidobj.ProcessId -Force; Write-Host "Stopped usb_monitor (PID $($pidobj.ProcessId)." } else { Write-Host "usb_monitor not found." } - Then open or attach the log:
C:\Users\<yourname>\Desktop\USB_Monitor.log
What I’ll look for once you attach the files
- Exact event lines near 12:55. I’ll extract and highlight:
- Any “usb … disconnect”, “reset high‑speed USB device”, or xhci_hcd / ehci_hcd / USBHUB messages at the drop time (those show a host/controller reset).
- Whether the Unifying receiver stayed enumerated (MouseDeviceInfo will show the receiver & device statuses). If the receiver stays present but only the mouse endpoint is being reset or shows retries, that indicates a device/radio/session issue.
- I’ll then give one single next action (update driver/BIOS and change port if host resets are present, or try spare receiver/Bluetooth/RMA if device‑side). This is the same decisive test we’ve been using.
- If the System events show a hub/controller port reset at 12:55 → update a specific chipset/USB driver or BIOS. If the receiver stayed present but the mouse endpoint failed → the problem is the mouse ↔ receiver radio/session (try Bluetooth or a different receiver and prepare an RMA if it follows the mouse).
- Paste the full contents of the two files here (MouseDeviceInfo.txt and USB_Events_Last10min.txt or -30min). I’ll parse them in‑line and reply instantly.
- Pull the exact log lines that decide host vs device,
- Explain in plain English what they mean, and
- Tell you the single next step to fix it.
- Joined
- Mar 14, 2023
- Messages
- 100,608
Thanks — that PowerShell error is harmless and easy to fix. You were trying to use Get‑WmiObject (which isn’t available the same way in newer PowerShell / Windows builds), so the command failed. Here are short, safe steps to (A) find and stop the usb_monitor you started, (B) check the monitor log, and (C) what to do next (capture the two decisive files if a drop already happened). I’ll also remind you how to restart the monitor the same way you started it.
1) Find & stop the monitor (two safe options)
A — If you saved a PID file earlier (usb_monitor.pid on Desktop) — easiest:
Open an elevated PowerShell (Run as Administrator) and run:
Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
B — If you did NOT create a PID file (search by the script name in the process command line)
Use Get-CimInstance (works in all PS versions) to find the process, then stop it:
(If multiple processes match, stop each ProcessId shown.
Why this works: Get‑CimInstance Win32_Process is the modern, cross‑version way to query running processes and their command lines; Get‑WmiObject sometimes errors on newer systems which is what you saw.
2) Verify / view the monitor log (quick)
After stopping (or if you just want to inspect while it’s running), view the last lines of the monitor log:
If the file doesn’t exist or is empty, the monitor may not have been running elevated — restart it elevated (steps below).
3) If a dropout happened and you want the decisive capture now
Run these two commands in an elevated PowerShell immediately (do NOT reboot first). They save the small, decisive files I asked for to your Desktop. Attach both files (MouseDeviceInfo.txt and USB_Events_Last10min.txt) and I’ll parse them the moment you upload.
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Notes:
Start it elevated and write the PID for easy stop later:
$p = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File
$p.Id | Out-File "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "USB monitor started (PID: $($p.Id). Log: $env:USERPROFILE\Desktop\USB_Monitor.log"
5) When you return / attach files
1) Find & stop the monitor (two safe options)
A — If you saved a PID file earlier (usb_monitor.pid on Desktop) — easiest:
Open an elevated PowerShell (Run as Administrator) and run:
Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
B — If you did NOT create a PID file (search by the script name in the process command line)
Use Get-CimInstance (works in all PS versions) to find the process, then stop it:
find the monitor process (shows ProcessId and CommandLine)
Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } | Select-Object ProcessId, CommandLineif the previous line printed a ProcessId (for example 1234), stop it:
Stop-Process -Id 1234 -Force(If multiple processes match, stop each ProcessId shown.
Why this works: Get‑CimInstance Win32_Process is the modern, cross‑version way to query running processes and their command lines; Get‑WmiObject sometimes errors on newer systems which is what you saw.
2) Verify / view the monitor log (quick)
After stopping (or if you just want to inspect while it’s running), view the last lines of the monitor log:
show last 200 lines of the monitor log
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200If the file doesn’t exist or is empty, the monitor may not have been running elevated — restart it elevated (steps below).
3) If a dropout happened and you want the decisive capture now
Run these two commands in an elevated PowerShell immediately (do NOT reboot first). They save the small, decisive files I asked for to your Desktop. Attach both files (MouseDeviceInfo.txt and USB_Events_Last10min.txt) and I’ll parse them the moment you upload.
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Notes:
- If USB_Events_Last10min.txt is empty, re-run with AddMinutes(-30) to capture a larger window:
$start = (Get-Date).AddMinutes(-30)
Start it elevated and write the PID for easy stop later:
$p = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File
"$env:USERPROFILE\Desktop\usb_monitor.ps1"" -WindowStyle Hidden -PassThru$p.Id | Out-File "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "USB monitor started (PID: $($p.Id). Log: $env:USERPROFILE\Desktop\USB_Monitor.log"
5) When you return / attach files
- Attach these files from your Desktop (paperclip/Attach files):
- USB_Monitor.log (if you used the monitor), and/or
- MouseDeviceInfo.txt and USB_Events_Last10min.txt (the immediate capture above).
- Tell me the approximate wall time of the dropout (you already said ~12:42 — fine). I’ll parse the logs and post the exact kernel / event lines that decide host controller reset vs device radio/session failure and then give the single next action (update a driver/BIOS, keep UGreen, swap receiver, or RMA).
- Show how to export USBLogView snapshots periodically using Task Scheduler (if you prefer that tool over the PowerShell monitor), or
- Draft the RMA/support text ready to paste (only if logs show the mouse itself is at fault).
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #248
PS C:\WINDOWS\system32> $start = (Get-Date).AddMinutes(-30)
>> Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
>> Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
>> Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
At line:3 char:86
+ ... e='System'; StartTime=$start} | Where-Object { $.ProviderName -match ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
Attach : The term 'Attach' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:1
+ Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (Attach:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\WINDOWS\system32>
>> Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
>> Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
>> Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
At line:3 char:86
+ ... e='System'; StartTime=$start} | Where-Object { $.ProviderName -match ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
Attach : The term 'Attach' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:4 char:1
+ Attach MouseDeviceInfo.txt and USB_Events_Last30min.txt.
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (Attach:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\WINDOWS\system32>
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #249
PS C:\WINDOWS\system32> Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } | Select-Object ProcessId, CommandLine
Get-CimInstance : Invalid class
At line:1 char:1
+ Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'us ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : MetadataError: (root\cimv2:Win32Process:String) [Get-CimInstance], CimException
+ FullyQualifiedErrorId : HRESULT 0x80041010,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand
PS C:\WINDOWS\system32>
Get-CimInstance : Invalid class
At line:1 char:1
+ Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'us ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : MetadataError: (root\cimv2:Win32Process:String) [Get-CimInstance], CimException
+ FullyQualifiedErrorId : HRESULT 0x80041010,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand
PS C:\WINDOWS\system32>
- Joined
- Mar 14, 2023
- Messages
- 100,608
Thanks — you did the right things and the errors you saw are just the small PowerShell typos (Get‑WmiObject vs Get‑CimInstance on newer systems, and using $_ not $ inside Where-Object). I’ll give the exact corrected commands you should run now (to stop the monitor, to collect the decisive logs, and to check the monitor log), plus short troubleshooting notes. When you attach the resulting files I’ll parse them immediately.
Quick context reminder
1) If you previously saved the PID to usb_monitor.pid (on Desktop):
Open an elevated PowerShell (Run as Administrator) and paste:
Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "Monitor stopped."
2) If you did NOT save a PID (search by command line and stop it):
Run these (Admin PowerShell):
Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
B — Confirm the monitor log exists and view recent lines
In Admin PowerShell:
Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If the file exists, it will show recent USB/Kernel events captured while you were away. If it doesn’t exist or is empty, the monitor may not have been running elevated — see Troubleshooting below.
C — If you saw a drop (decisive capture) — run these exact corrected commands now
Run these three lines in an elevated PowerShell (copy/paste interactively). They set $start in the same session and create two small files on your Desktop that I can parse:
$start = (Get-Date).AddMinutes(-30)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} |
Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } |
Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message |
Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
Notes:
Attach these files from your Desktop:
$p.Id | Out-File "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "USB monitor started (PID: $($p.Id). Log: $env:USERPROFILE\Desktop\USB_Monitor.log"
F — Quick manual Event Viewer alternative (if you prefer GUI)
Quick context reminder
- You started the usb_monitor.ps1 before you left and reported at least one permanent drop while you were out (~12:42–12:55 window). I’ll use the logs you produce to decide whether Windows reset the USB host/controller or the mouse/receiver radio/session failed.
1) If you previously saved the PID to usb_monitor.pid (on Desktop):
Open an elevated PowerShell (Run as Administrator) and paste:
Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "Monitor stopped."
2) If you did NOT save a PID (search by command line and stop it):
Run these (Admin PowerShell):
Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
Note the ProcessId(s) printed, then run:
Get-CimInstance Win32Process | Where-Object { $.CommandLine -like 'usb_monitor.ps1' } | ForEach-Object { Stop-Process -Id $.ProcessId -Force; "Stopped PID: $($.ProcessId)" }B — Confirm the monitor log exists and view recent lines
In Admin PowerShell:
Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If the file exists, it will show recent USB/Kernel events captured while you were away. If it doesn’t exist or is empty, the monitor may not have been running elevated — see Troubleshooting below.
C — If you saw a drop (decisive capture) — run these exact corrected commands now
Run these three lines in an elevated PowerShell (copy/paste interactively). They set $start in the same session and create two small files on your Desktop that I can parse:
$start = (Get-Date).AddMinutes(-30)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} |
Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } |
Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message |
Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
Notes:
- I used AddMinutes(-30) to cover a larger window; change to -10 if you want a narrower slice.
- Important: run these interactively in the same PowerShell session (don’t paste them into a saved .ps1) so $start is defined and used.
- Do NOT reboot before running these commands — reboot clears the events we need.
Attach these files from your Desktop:
- MouseDeviceInfo.txt
- USB_Events_Last30min.txt
- (Optional) USB_Monitor.log if it exists
- Look for kernel/USB event lines like “usb … disconnect”, “reset high‑speed USB device”, xhci_hcd / ehci_hcd / USBHUB messages (these indicate a host/controller reset), or for only device‑level retries / “device doesn't respond” (these indicate a mouse ↔ receiver radio/session issue).
- Then I’ll give the one exact next step: update a specific chipset/USB driver or BIOS if it’s a host reset, or swap receiver / Bluetooth / RMA wording if it’s device/radio.
- If Get-WinEvent returns no results, increase the window (AddMinutes(-60) and re-run the Get-WinEvent line.
- If the monitor log is empty, the monitor may have started without Admin rights. Restart it with the Start-Process command (copy/paste into an elevated PowerShell):
"$env:USERPROFILE\Desktop\usb_monitor.ps1"" -WindowStyle Hidden -PassThru$p.Id | Out-File "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "USB monitor started (PID: $($p.Id). Log: $env:USERPROFILE\Desktop\USB_Monitor.log"
F — Quick manual Event Viewer alternative (if you prefer GUI)
- Open Event Viewer → Windows Logs → System → Action → Filter Current Log → in the XML or Message filter include keywords: Kernel‑PnP, USB, USBHUB, xhci_hcd; set time range to the drop time; export the filtered results to a file and attach it.
- The errors you saw came from two things: using Get‑WmiObject vs Get‑CimInstance, and using $.ProviderName / $.Message instead of the correct pipeline variable $.ProviderName and $.Message. The corrected commands above use the working $_ variable and Get‑CimInstance for process search if you need to find the monitor process.
- Joined
- Mar 14, 2023
- Messages
- 100,608
Got it — the Get‑CimInstance error means that WMI/CIM query didn’t work on your system. That’s fine — we can find and stop the monitor by looking at running PowerShell processes and stopping the one you started.
Do this in an elevated PowerShell (Run as Administrator). I’ll give short commands — run them one at a time and stop the process whose StartTime matches when you started the monitor.
1) List running PowerShell processes and pick the one you started
Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
Stop-Process -Id <PID> -Force
3) Verify the monitor stopped
Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
(If you still see a powershell process with the same StartTime, stop that too — but be careful to avoid stopping any other interactive PowerShell sessions you want to keep.
If Get-Process can’t show StartTime (older systems / permissions), use tasklist to identify PIDs:
tasklist /fi "imagename eq powershell.exe" /v
Then stop the suspected PID:
Stop-Process -Id <PID> -Force
4) Check the monitor log
Once stopped, check the log file and show the tail (this is the file to attach if a dropout occurred):
Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If the log contains lines around your reported dropout (~12:42), attach that USB_Monitor.log file here and I’ll parse it immediately. If there’s nothing useful in the monitor log, run the two decisive captures I asked for (immediately after a drop) and attach those files instead:
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select TimeCreated, ProviderName, Id, LevelDisplayName, Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last10min.txt and I’ll parse right away.
If you want, paste the output of step (1) here (the Get-Process list) and I’ll point exactly which PID to stop.
Do this in an elevated PowerShell (Run as Administrator). I’ll give short commands — run them one at a time and stop the process whose StartTime matches when you started the monitor.
1) List running PowerShell processes and pick the one you started
Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
- Look for a powershell.exe with a StartTime close to when you ran Start-Process (about 11:54). Note its Id.
Stop-Process -Id <PID> -Force
3) Verify the monitor stopped
Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
(If you still see a powershell process with the same StartTime, stop that too — but be careful to avoid stopping any other interactive PowerShell sessions you want to keep.
If Get-Process can’t show StartTime (older systems / permissions), use tasklist to identify PIDs:
tasklist /fi "imagename eq powershell.exe" /v
Then stop the suspected PID:
Stop-Process -Id <PID> -Force
4) Check the monitor log
Once stopped, check the log file and show the tail (this is the file to attach if a dropout occurred):
Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If the log contains lines around your reported dropout (~12:42), attach that USB_Monitor.log file here and I’ll parse it immediately. If there’s nothing useful in the monitor log, run the two decisive captures I asked for (immediately after a drop) and attach those files instead:
$start = (Get-Date).AddMinutes(-10)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select TimeCreated, ProviderName, Id, LevelDisplayName, Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Attach MouseDeviceInfo.txt and USB_Events_Last10min.txt and I’ll parse right away.
If you want, paste the output of step (1) here (the Get-Process list) and I’ll point exactly which PID to stop.
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #252
PS C:\WINDOWS\system32> Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
>> Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
>> Write-Host "Monitor stopped."
Get-Content : Cannot find path 'C:\Users\rupes\Desktop\usb_monitor.pid' because it does not exist.
At line:1 char:19
+ ... rocess -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (C:\Users\rupes\Desktop\usb_monitor.pid:String) [Get-Content], ItemNotFo
undException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
Stop-Process : Cannot bind argument to parameter 'Id' because it is null.
At line:1 char:18
+ ... Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData: ) [Stop-Process], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.StopProcess
Command
Remove-Item : Cannot find path 'C:\Users\rupes\Desktop\usb_monitor.pid' because it does not exist.
At line:2 char:1
+ Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (C:\Users\rupes\Desktop\usb_monitor.pid:String) [Remove-Item], ItemNotFo
undException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand
Monitor stopped.
PS C:\WINDOWS\system32>
>> Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
>> Write-Host "Monitor stopped."
Get-Content : Cannot find path 'C:\Users\rupes\Desktop\usb_monitor.pid' because it does not exist.
At line:1 char:19
+ ... rocess -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (C:\Users\rupes\Desktop\usb_monitor.pid:String) [Get-Content], ItemNotFo
undException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
Stop-Process : Cannot bind argument to parameter 'Id' because it is null.
At line:1 char:18
+ ... Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData:
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.StopProcess
Command
Remove-Item : Cannot find path 'C:\Users\rupes\Desktop\usb_monitor.pid' because it does not exist.
At line:2 char:1
+ Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (C:\Users\rupes\Desktop\usb_monitor.pid:String) [Remove-Item], ItemNotFo
undException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand
Monitor stopped.
PS C:\WINDOWS\system32>
- Joined
- Mar 14, 2023
- Messages
- 100,608
Thanks — you’re almost done. The error you saw just means the PID file wasn’t created (or was removed), so Stop‑by‑PID failed. Don’t worry — here are three safe ways to find and stop the hidden usb_monitor PowerShell process, then verify the log and (if a drop happened) capture the two decisive files I need.
Pick one of the “Find & stop” options below (A is simplest and safest).
A — Recommended (inspect running PowerShell processes, then stop the one you started)
B — If you prefer a one‑shot kill by matching the script name (WMIC) — fallback
(Some systems still support WMIC; it shows command line for processes.
wmic process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine
C — If the above fail, stop all non‑interactive PowerShell instances started recently (use cautiously)
(Only use this if you don’t have important interactive PowerShell sessions open.
Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff } | Select-Object Id,StartTime | ForEach-Object { Stop-Process -Id $.Id -Force; "Stopped PID $($_.Id)" }
— Do not run C unless you understand this will terminate recent PowerShell processes.
Verify the monitor log and attach it
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If a permanent disconnect happened (you said ~12:42), run these immediately (Admin PowerShell). These create two small files on your Desktop that I’ll parse and give the single next action:
$start = (Get-Date).AddMinutes(-30) # wider window to be safe
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
Pick one of the “Find & stop” options below (A is simplest and safest).
A — Recommended (inspect running PowerShell processes, then stop the one you started)
- Open PowerShell as Administrator.
- Run this to list all running PowerShell processes and their StartTime so you can identify the one you started (~11:54):
- Look for the entry whose StartTime matches when you launched the monitor (about 11:54). Note its Id (PID).
- Stop that PID (replace <PID> with the number you saw):
- Confirm it stopped:
B — If you prefer a one‑shot kill by matching the script name (WMIC) — fallback
(Some systems still support WMIC; it shows command line for processes.
wmic process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine
note the ProcessId printed, then:
taskkill /PID <ProcessId> /FC — If the above fail, stop all non‑interactive PowerShell instances started recently (use cautiously)
(Only use this if you don’t have important interactive PowerShell sessions open.
stop powershells started in the last 3 hours
$cutoff = (Get-Date).AddHours(-3)Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff } | Select-Object Id,StartTime | ForEach-Object { Stop-Process -Id $.Id -Force; "Stopped PID $($_.Id)" }
— Do not run C unless you understand this will terminate recent PowerShell processes.
Verify the monitor log and attach it
- Check the monitor log (show last 200 lines):
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
- If it contains entries around the time you reported (~12:42), attach USB_Monitor.log to your reply (paperclip). I’ll parse it and extract the USB/kernel lines that matter.
If a permanent disconnect happened (you said ~12:42), run these immediately (Admin PowerShell). These create two small files on your Desktop that I’ll parse and give the single next action:
$start = (Get-Date).AddMinutes(-30) # wider window to be safe
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last10min.txt"
- Attach both Desktop files (MouseDeviceInfo.txt and USB_Events_Last10min.txt) and tell me the approximate wall clock time of the drop (12:42 is fine). I’ll parse those immediately and tell you exactly whether Windows reset the host/controller (driver/BIOS fix) or whether it was a per‑device radio/session failure (swap/RMA advice).
- It likely wasn’t running with Admin rights. Re‑start it elevated (I can paste the exact Start-Process command again) or use the above immediate capture when the next drop happens.
- Stop the monitor using Option A (Get-Process → Stop-Process).
- Inspect USB_Monitor.log (Get-Content … -Tail 200) and attach if it contains entries near 12:42.
- If you already have the two Windows captures, attach MouseDeviceInfo.txt and USB_Events_Last10min.txt now.
- I’ll parse the logs and give the single next action (driver/BIOS update vs swap/RMA).
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #254
PS C:\WINDOWS\system32> Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
Id StartTime CPU Path
-- --------- --- ----
5444 22/10/2025 12:53:41 0.671875 C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
20336 22/10/2025 12:12:54 4.34375 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32> Stop-Process -Id 5444 -Force
PS C:\WINDOWS\system32> Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
Id StartTime CPU Path
-- --------- --- ----
20336 22/10/2025 12:12:54 4.484375 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32>
Id StartTime CPU Path
-- --------- --- ----
5444 22/10/2025 12:53:41 0.671875 C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
20336 22/10/2025 12:12:54 4.34375 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32> Stop-Process -Id 5444 -Force
PS C:\WINDOWS\system32> Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path
Id StartTime CPU Path
-- --------- --- ----
20336 22/10/2025 12:12:54 4.484375 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32>
- Joined
- Mar 14, 2023
- Messages
- 100,608
Thanks — good work. You stopped PID 5444; a single PowerShell process (PID 20336) remains. That may be the usb_monitor or another PowerShell session.
Quick next steps (safe, 1–3 minutes)
1) Stop the remaining PowerShell monitor (optional)
Get-Process -Name powershell | Select-Object Id,StartTime,CPU,Path
If that returns no powershell processes you didn’t expect, the monitor is stopped. If you prefer to leave an interactive PowerShell open, don’t stop it — just stop the one with the StartTime you recognise as the monitor.
2) Capture decisive Windows logs for the 12:42 permanent drop (run now)
You said USB_Events_Last10min was empty earlier. To be sure we capture the 12:42 drop, please run these two commands in an elevated (Admin) PowerShell now — they use a larger window (last 60 minutes) so we catch everything from this morning:
$start = (Get-Date).AddMinutes(-60)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device|xhci|ehci' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last60min.txt"
Why this is the right capture
Quick next steps (safe, 1–3 minutes)
1) Stop the remaining PowerShell monitor (optional)
- If you want to stop any background monitor now, run this (Admin PowerShell). It will stop PID 20336 you listed:
Get-Process -Name powershell | Select-Object Id,StartTime,CPU,Path
If that returns no powershell processes you didn’t expect, the monitor is stopped. If you prefer to leave an interactive PowerShell open, don’t stop it — just stop the one with the StartTime you recognise as the monitor.
2) Capture decisive Windows logs for the 12:42 permanent drop (run now)
You said USB_Events_Last10min was empty earlier. To be sure we capture the 12:42 drop, please run these two commands in an elevated (Admin) PowerShell now — they use a larger window (last 60 minutes) so we catch everything from this morning:
$start = (Get-Date).AddMinutes(-60)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} | Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device|xhci|ehci' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message | Out-File "$env:USERPROFILE\Desktop\USB_Events_Last60min.txt"
- After those finish, attach both files from your Desktop:
- MouseDeviceInfo.txt
- USB_Events_Last60min.txt
Why this is the right capture
- The System events (USB_Events_Last60min.txt) will show whether Windows performed a hub/controller/xHCI reset at the drop time (which points to a host/controller problem) or whether you’ll see only per‑device retries / “device doesn’t respond” entries while the Unifying receiver remains present (which points to a mouse‑side radio/session failure). The device list (MouseDeviceInfo.txt) shows whether Windows still sees the receiver and mouse and their Status. Together they’re decisive.
- Your earlier Linux + Unifying report evidence (device stayed enumerated; dmesg showing per‑device reset and Unifying log “Device doesn't respond!!”) already strongly pointed at a mouse ↔ receiver radio/session problem rather than the whole USB controller crashing. Keeping the receiver on the UGreen extension fixed the permanent disconnects earlier — that’s the highest‑ROI workaround. We’ll confirm that for the 12:42 drop from these Windows logs.
- You can open each Desktop file and paste the full contents into your reply (they’re small). I’ll parse inline.
- Say “Stop it” and I’ll assume you want to terminate PID 20336 and give the exact one‑line to paste in elevated PowerShell (Stop-Process -Id 20336 -Force).
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #256
PS C:\WINDOWS\system32> Get-Process -Name powershell | Select-Object Id, StartTime, CPU, Path | Sort-Object StartTime -Descending
Id StartTime CPU Path
-- --------- --- ----
20336 22/10/2025 12:12:54 4.53125 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32> wmic process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine
CommandLine ProcessId
"C:\WINDOWS\System32\Wbem\WMIC.exe" process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine 21900
PS C:\WINDOWS\system32> taskkill /PID 21900 /F
ERROR: The process "21900" not found.
PS C:\WINDOWS\system32> $cutoff = (Get-Date).AddHours(-3)
PS C:\WINDOWS\system32> Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff } | Select-Object Id,StartTime | ForEach-Object { Stop-Process -Id $.Id -Force; "Stopped PID $($_.Id)" }
$.StartTime : The term '$.StartTime' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path
is correct and try again.
At line:1 char:47
+ Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff ...
+ ~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.StartTime:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\WINDOWS\system32> Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
True
PS C:\WINDOWS\system32> Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
--- USB monitor started at 2025-10-22T12:53:41.9553191+01:00 ---
PS C:\WINDOWS\system32>
Id StartTime CPU Path
-- --------- --- ----
20336 22/10/2025 12:12:54 4.53125 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PS C:\WINDOWS\system32> wmic process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine
CommandLine ProcessId
"C:\WINDOWS\System32\Wbem\WMIC.exe" process where "CommandLine like '%usb_monitor.ps1%'" get ProcessId,CommandLine 21900
PS C:\WINDOWS\system32> taskkill /PID 21900 /F
ERROR: The process "21900" not found.
PS C:\WINDOWS\system32> $cutoff = (Get-Date).AddHours(-3)
PS C:\WINDOWS\system32> Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff } | Select-Object Id,StartTime | ForEach-Object { Stop-Process -Id $.Id -Force; "Stopped PID $($_.Id)" }
$.StartTime : The term '$.StartTime' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path
is correct and try again.
At line:1 char:47
+ Get-Process -Name powershell | Where-Object { $.StartTime -gt $cutoff ...
+ ~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.StartTime:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\WINDOWS\system32> Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
True
PS C:\WINDOWS\system32> Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
--- USB monitor started at 2025-10-22T12:53:41.9553191+01:00 ---
PS C:\WINDOWS\system32>
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #257
--- USB monitor started at 2025-10-22T12:53:41.9553191+01:00 ---
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #258
Don't see a file USB_Events_Last60min.txt only USB_Events_Last30min.txt and its empty.
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
Distorted Vision
Senior Member
- Joined
- Jun 18, 2022
- Messages
- 480
- Thread Author
-
- #260
I want to expediate testing with the second spare Unifying Receiver and then with Bluetooth.
I've started with the second spare Unifying Receiver. I noticed this looks different as it says 'Logi' instead of 'Logitech' on it. I think its a newer version of it.
I unpaired both the K800 and MX Master 3 with the old receiver and paired with the new.
No drops so far and running usb_monitor.ps1 but I'm going to leave it for a few hours to see if it gets a permanent disconnect.
I've started with the second spare Unifying Receiver. I noticed this looks different as it says 'Logi' instead of 'Logitech' on it. I think its a newer version of it.
I unpaired both the K800 and MX Master 3 with the old receiver and paired with the new.
No drops so far and running usb_monitor.ps1 but I'm going to leave it for a few hours to see if it gets a permanent disconnect.
Similar threads
- Article
- Replies
- 0
- Views
- 304
- Article
- Replies
- 0
- Views
- 26
- Article
- Replies
- 0
- Views
- 38
- Article
- Replies
- 0
- Views
- 34
- Replies
- 1
- Views
- 4K