USB drive Monitor Example

[jftuga]

Thanks for all of the work on this script. It may useful for the place that I work at.

-John

[ptrex]

@jftuga

You are welcome !!

regards,

ptrex

[arcker]

please can you tel me, how i can get the removal drive latter from this code like H: M: L:. i want to know which drive is latter is created by the removal detection...thank you...please

$strComputer = "."
 $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

 $colEvents = $objWMIService.ExecNotificationQuery _
    ("Select * From __InstanceOperationEvent Within 5 Where " _
        & "TargetInstance isa 'Win32_LogicalDisk'")

While 1
     $objEvent = $colEvents.NextEvent
    If $objEvent.TargetInstance.DriveType = 2 Then 
        Select 
            Case $objEvent.Path_.Class()="__InstanceCreationEvent"
                Consolewrite("Drive " & $objEvent.TargetInstance.DeviceId & "has been added." & @CR)
            Case $objEvent.Path_.Class()="__InstanceDeletionEvent"
                Consolewrite("Drive " & $objEvent.TargetInstance.DeviceId & "has been removed."& @CR)
        EndSelect
    EndIf
WEnd

quick edit, not testing, try it

$strComputer = "."
 $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

 $colEvents = $objWMIService.ExecNotificationQuery _
    ("Select * From __InstanceOperationEvent Within 5 Where " _
        & "TargetInstance isa 'Win32_LogicalDisk'")

While 1
     $objEvent = $colEvents.NextEvent
    If $objEvent.TargetInstance.DriveType = 2 Then 
        Select 
            Case $objEvent.Path_.Class()="__InstanceCreationEvent"
                Consolewrite("Drive " & $objEvent.TargetInstance.Name & "has been added." & @CR)
            Case $objEvent.Path_.Class()="__InstanceDeletionEvent"
                Consolewrite("Drive " & $objEvent.TargetInstance.Name & "has been removed."& @CR)
        EndSelect
    EndIf
WEnd