PS C:\WINDOWS\system32> $start = Get-Date "2025-10-22 17:30:00"
PS C:\WINDOWS\system32> Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} |
>> Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsoft-Windows-DriverFrameworks-UserMode' -or $.Message -match 'USB|usb|hub|reset|removed|disconnect|device|xhci|ehci|HID' } |
>> Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message |
>> Out-File "$env:USERPROFILE\Desktop\USB_Events_wide_1730-2000.txt"
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
$.ProviderName : The term '$.ProviderName' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the
spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:2 char:16
+ Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB|Microsof ...
+ ~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.ProviderName:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
PS C:\WINDOWS\system32> Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID_0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo_postdrop.txt"
PS C:\WINDOWS\system32> Get-WinEvent -MaxEvents 500 -LogName System | Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | Out-File "$env:USERPROFILE\Desktop\System_Last500.txt"
PS C:\WINDOWS\system32> Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force -ErrorAction SilentlyContinue
>> Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid" -ErrorAction SilentlyContinue
Get-Content : Cannot find path 'C:\Users\rupes\Desktop\usb_monitor.pid' because it does not exist.
At line:1 char:19
+ ... rocess -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (C:\Users\rupes\Desktop\usb_monitor.pid:String) [Get-Content], ItemNotFoundException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
Stop-Process : Cannot bind argument to parameter 'Id' because it is null.
At line:1 char:18
+ ... Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidData:
) [Stop-Process], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.StopProcessCommand
PS C:\WINDOWS\system32>