Windows 2012 DriverFrameworks-UserMode - Detect USB connection

[Cos123]

Hello, in Windows 7 whenever you plugged a USB flash drive it generate events in the DriverFrameWorks-UserMode event log, which is handy as you can attach a task to it and run a script. In Windows 2012 the DriverFrameWorks service and event logs are disabled by default, i've enabled them both but the only event that get's generated is the ID1000 indicating that the service has started.

Does anyone know if there's something else that needs to be turned on for USB events to be logged in Windows 2012?

Thanks

Continue reading...