Thanks — you did the right things and the errors you saw are just the small PowerShell typos (Get‑WmiObject vs Get‑CimInstance on newer systems, and using $_ not $ inside Where-Object). I’ll give the exact corrected commands you should run now (to stop the monitor, to collect the decisive logs, and to check the monitor log), plus short troubleshooting notes. When you attach the resulting files I’ll parse them immediately.
Quick context reminder
- You started the usb_monitor.ps1 before you left and reported at least one permanent drop while you were out (~12:42–12:55 window). I’ll use the logs you produce to decide whether Windows reset the USB host/controller or the mouse/receiver radio/session failed.
A — How to stop the monitor safely (pick one)
1) If you previously saved the PID to usb_monitor.pid (on Desktop):
Open an elevated PowerShell (Run as Administrator) and paste:
Stop-Process -Id (Get-Content "$env:USERPROFILE\Desktop\usb_monitor.pid") -Force
Remove-Item "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "Monitor stopped."
2) If you did NOT save a PID (search by command line and stop it):
Run these (Admin PowerShell):
Get-CimInstance Win32
Process | Where-Object { $.CommandLine -like '
usb_monitor.ps1' } | Select-Object ProcessId,CommandLine
Note the ProcessId(s) printed, then run:
Get-CimInstance Win32
Process | Where-Object { $.CommandLine -like '
usb_monitor.ps1' } | ForEach-Object { Stop-Process -Id $
.ProcessId -Force; "Stopped PID: $($.ProcessId)" }
B — Confirm the monitor log exists and view recent lines
In Admin PowerShell:
Test-Path "$env:USERPROFILE\Desktop\USB_Monitor.log"
Get-Content "$env:USERPROFILE\Desktop\USB_Monitor.log" -Tail 200
If the file exists, it will show recent USB/Kernel events captured while you were away. If it doesn’t exist or is empty, the monitor may not have been running elevated — see Troubleshooting below.
C — If you saw a drop (decisive capture) — run these exact corrected commands now
Run these three lines in an elevated PowerShell (copy/paste interactively). They set $start in the same session and create two small files on your Desktop that I can parse:
$start = (Get-Date).AddMinutes(-30)
Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match 'VID_046D|VID
0A5C' } | Format-List FriendlyName,InstanceId,Status | Out-File "$env:USERPROFILE\Desktop\MouseDeviceInfo.txt"
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$start} |
Where-Object { $.ProviderName -match 'Kernel-PnP|USBHUB3|USB' -or $_.Message -match 'USB|usb|hub|reset|removed|disconnect|device' } |
Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message |
Out-File "$env:USERPROFILE\Desktop\USB_Events_Last30min.txt"
Notes:
- I used AddMinutes(-30) to cover a larger window; change to -10 if you want a narrower slice.
- Important: run these interactively in the same PowerShell session (don’t paste them into a saved .ps1) so $start is defined and used.
- Do NOT reboot before running these commands — reboot clears the events we need.
D — What to attach here (I’ll parse these immediately)
Attach these files from your Desktop:
- MouseDeviceInfo.txt
- USB_Events_Last30min.txt
- (Optional) USB_Monitor.log if it exists
When you attach them I will:
- Look for kernel/USB event lines like “usb … disconnect”, “reset high‑speed USB device”, xhci_hcd / ehci_hcd / USBHUB messages (these indicate a host/controller reset), or for only device‑level retries / “device doesn't respond” (these indicate a mouse ↔ receiver radio/session issue).
- Then I’ll give the one exact next step: update a specific chipset/USB driver or BIOS if it’s a host reset, or swap receiver / Bluetooth / RMA wording if it’s device/radio.
E — Quick troubleshooting if the monitor file is empty or the commands error
- If Get-WinEvent returns no results, increase the window (AddMinutes(-60)) and re-run the Get-WinEvent line.
- If the monitor log is empty, the monitor may have started without Admin rights. Restart it with the Start-Process command (copy/paste into an elevated PowerShell):
$p = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File
"$env:USERPROFILE\Desktop\usb_monitor.ps1"" -WindowStyle Hidden -PassThru
$p.Id | Out-File "$env:USERPROFILE\Desktop\usb_monitor.pid"
Write-Host "USB monitor started (PID: $($p.Id)). Log: $env:USERPROFILE\Desktop\USB_Monitor.log"
F — Quick manual Event Viewer alternative (if you prefer GUI)
- Open Event Viewer → Windows Logs → System → Action → Filter Current Log → in the XML or Message filter include keywords: Kernel‑PnP, USB, USBHUB, xhci_hcd; set time range to the drop time; export the filtered results to a file and attach it.
G — One final note on the typos you hit
- The errors you saw came from two things: using Get‑WmiObject vs Get‑CimInstance, and using $.ProviderName / $.Message instead of the correct pipeline variable $.ProviderName and $.Message. The corrected commands above use the working $_ variable and Get‑CimInstance for process search if you need to find the monitor process.
When you return and attach the two files I requested, I will parse them and post the exact kernel/event lines that decide whether to update drivers/BIOS (host reset) or to replace the mouse/receiver (device). If you want, attach the files now — I’ll parse immediately; otherwise stop the monitor when you return, attach USB_Monitor.log and/or run the two capture lines and attach those files.
) [Get-WmiObject], ManagementException
