{"id":50663,"date":"2010-04-13T00:01:00","date_gmt":"2010-04-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/04\/13\/hey-scripting-guy-how-can-i-be-notified-when-a-usb-drive-is-plugged-into-my-computer\/"},"modified":"2010-04-13T00:01:00","modified_gmt":"2010-04-13T00:01:00","slug":"hey-scripting-guy-how-can-i-be-notified-when-a-usb-drive-is-plugged-into-my-computer","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-how-can-i-be-notified-when-a-usb-drive-is-plugged-into-my-computer\/","title":{"rendered":"Hey, Scripting Guy! How Can I Be Notified When a USB Drive Is Plugged into My Computer?"},"content":{"rendered":"

\"Bookmark<\/a><\/p>\n

 \n\"Hey,<\/p>\n

Hey, Scripting Guy! I would like to be notified when I plug in a USB drive into my computer. I have some cool ideas for using that, but I do not know how to detect when a USB drive is plugged in. I know I can run a script that loops through looking for all drives, and compares them with a previous collection of drives and then looks for differences. I also know I can use the Compare-Object<\/strong> cmdlet to make the comparison, so it would not be too terribly hard, but it seems inefficient. Is there a better way to do this?<\/p>\n

— SP<\/p>\n

\n

 <\/p>\n<\/p>\n

\"Hey,Hello SP, <\/p>\n

Microsoft Scripting Guy Ed Wilson here. We are getting closer and closer to the 2010 Scripting Games<\/a>. They begin on April 26 and will run for two weeks. Registration<\/a> has been open for a week or so, and we encourage you to sign up. It takes less than a minute because you can use your Windows Live ID. Craig has rounded up some really cool prizes (Scripting Editor<\/i>: I don’t know who this Craig guy is, but he sounds really awesome), and some of the Windows PowerShell user groups are even offering additional prizes for their members who participate. <\/p>\n

SP, what you need to do is investigate WMI events. We have lots of Hey, Scripting Guy! Blog posts that talk about using WMI events from within VBScript<\/font><\/a>. We also have several Hey, Scripting Guy! posts that deal with WMI events from Windows PowerShell<\/font><\/a>. <\/p>\n

There are two types of WMI event classes that can be used. The first are intrinsic event classes, which are WMI classes that are designed to monitor for events. All these classes do is monitor for WMI events. An example of an intrinsic WMI event class is Win32_ProcessStartTrace<\/font><\/a>. Because this is an intrinsic WMI class, you cannot use the Get-WmiObject<\/b> (gwmi<\/b> alias) cmdlet and pass the WMI class to the Get-Member<\/b> (gm<\/b> alias) cmdlet and see its properties and methods. An error is generated that states that no object has been supplied to the Get-Member<\/b> cmdlet. This is true because the Win32_ProcessStartTrace<\/b> WMI class is created when a new process is generated and WMI is configured to watch for new processes to start up. <\/p>\n

PS C:> gwmi win32_processStartTrace | gm
Get-Member : No object has been specified to the Get-Member cmdlet.
At line:1 char:34
+ gwmi win32_processStartTrace | gm <<<<
    <\/span>+ CategoryInfo          <\/span>: CloseError: (:) [Get-Member], InvalidOperationException
    <\/span>+ FullyQualifiedErrorId : NoObjectInGetMember,Microsoft.PowerShell.Commands.GetMemberCommand<\/p>\n

PS C:><\/p>\n

<\/font><\/span><\/p>\n

To use a “regular” WMI class to monitor for WMI events, it is necessary to use a generic WMI event class such as __InstanceCreationEvent<\/font><\/a>. The thing that is cool about using the __InstanceCreationEvent<\/b> WMI class is that it returns a complete copy of the WMI object that created the event. This allows you to obtain a lot of very useful information about the event. To use the __InstanceCreationEvent<\/b> WMI class, it is necessary to compose an “event query.” You can do this by typing directly into the –query<\/b> property of the Windows PowerShell console. The following is a single-line command that is wrapped onto two lines. To avoid confusion, I did not break it into two separate lines, nor did I close and open extra quotation marks and use line continuation. If you cut and paste the command, please ensure you have one line of code by either pasting it in Notepad and cleaning it up, or in the Windows PowerShell ISE before running the command:<\/p>\n

Register-WmiEvent -Query “Select * from __InstanceCreationEvent within 5 where targetinstance isa ‘win32_logicaldisk'” -SourceIdentifier disk -Timeout 1000<\/p>\n

<\/font><\/span><\/p>\n

When you run the command, nothing is returned and nothing appears to have happened. When a USB drive is plugged into the computer, still nothing appears to happen. However, if you want to retrieve the event that was returned, use the Get-Event<\/b> cmdlet as seen here:<\/p>\n

PS C:> Get-Event -SourceIdentifier disk<\/p>\n

ComputerName     <\/span>:
RunspaceId       <\/span>: 1564db50-15ae-4970-8ad3-d759d3092d96
EventIdentifier  <\/span>: 1
Sender           <\/span>: System.Management.ManagementEventWatcher
SourceEventArgs  <\/span>: System.Management.EventArrivedEventArgs
SourceArgs       <\/span>: {System.Management.ManagementEventWatcher, System.Management.EventArrivedEventArgs}
SourceIdentifier : disk
TimeGenerated    <\/span>: 4\/9\/2010 12:10:16 PM
MessageData      <\/span>:<\/p>\n

<\/font><\/span><\/p>\n

The information that is returned by the Get-Event<\/b> cmdlet is les\ns than illuminating. But this is only because it returns several different objects. To find information about the newly inserted drive, store the object in a variable:<\/p>\n

$a = Get-Event -SourceIdentifier disk<\/p>\n

<\/font><\/span><\/p>\n

Once you have the object stored in a variable, it is easy to query the TargetInstance<\/b> from the NewEvent<\/b> object. This is seen here:<\/p>\n

$a.SourceEventArgs.NewEvent.TargetInstance<\/p>\n

<\/font><\/span><\/p>\n

When you run these commands, you receive the output shown in the following image.<\/p>\n

\"Image<\/p>\n

\n

 <\/p>\n<\/p>\n

SP, that is all there is to using WMI events. WMI Week will continue tomorrow. <\/p>\n

If you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/font><\/a> or Facebook<\/a>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/font><\/a> or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

<\/p>\n

 <\/p>\n

<\/span><\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/p>\n

<\/span><\/b><\/p>\n

<\/span><\/b> <\/p>\n","protected":false},"excerpt":{"rendered":"

  Hey, Scripting Guy! I would like to be notified when I plug in a USB drive into my computer. I have some cool ideas for using that, but I do not know how to detect when a USB drive is plugged in. I know I can run a script that loops through looking for […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[42,3,4,45,6],"class_list":["post-50663","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-events-and-monitoring","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell","tag-wmi"],"acf":[],"blog_post_summary":"

  Hey, Scripting Guy! I would like to be notified when I plug in a USB drive into my computer. I have some cool ideas for using that, but I do not know how to detect when a USB drive is plugged in. I know I can run a script that loops through looking for […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/50663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=50663"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/50663\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=50663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=50663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=50663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}