How to log "new pnp devices" events to console on Windows? - powershell

Question

I want to write something like nestat (that log new tcp connections to console) but for pnp devices with powershell.
Is there an API method "to subscribe to some kind of events bus" specific to PnP and get "connected" and "disconnected" events?
Or only one way to achive this is looping with Get-PnpDevice and "manually" seacrh for the differences?

Answer 1

You can use WMI events to do this. For example, here is one way to do it (seems over-complicated, so maybe someone can improve on it):
$addIdentifier = "WMI.PnpAddEvent"
$removeIdentifier = "WMI.PnpRemoveEvent"
$addAction = { $pnpEntity = $EventArgs.NewEvent.TargetInstance; Write-Host "`nPNPEvent: Plugged In`nCaption: $($pnpEntity.Caption)`nPNPDeviceID: $($pnpEntity.PNPDeviceID)`n" }
$addQuery = "SELECT * FROM __instancecreationevent WITHIN 5 WHERE targetinstance isa 'Win32_PnPEntity'"
$removeAction = { $pnpEntity = $EventArgs.NewEvent.TargetInstance; Write-Host "`nPNPEvent: Unplugged`nCaption: $($pnpEntity.Caption)`nPNPDeviceID: $($pnpEntity.PNPDeviceID)`n" }
$removeQuery = "SELECT * FROM __instancedeletionevent WITHIN 5 WHERE targetinstance isa 'Win32_PnPEntity'"
$addEventArgs = #{
Query = $addQuery
SourceIdentifier = $addIdentifier
SupportEvent = $true
Action = $addAction
}
$removeEventArgs = #{
Query = $removeQuery
SourceIdentifier = $removeIdentifier
SupportEvent = $true
Action = $removeAction
}
Register-WmiEvent #addEventArgs
Register-WmiEvent #removeEventArgs
Now, when you add/remove a device, you'll get output like this in the console:
PNPEvent: Unplugged
Caption: Apple iPhone
PNPDeviceID: USB\VID_05AC&PID_12A8&MI_00\E&2491F388&0&0000
PNPEvent: Plugged In
Caption: Apple iPhone
PNPDeviceID: USB\VID_05AC&PID_12A8&MI_00\E&2491F388&0&0000
A couple of things to keep in mind:
The event registrations last for the current session only
You need to run this from an elevated prompt
As mentioned, the registrations should be cancelled when your session ends, but if you want to do it manually, you can do it like this:
$addIdentifier, $removeIdentifier | ForEach-Object { Unregister-Event -Force -SourceIdentifier $_ }