Phone Get Quote
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to detect USB devices without using PowerShell

A organization's information can be stolen in multiple ways, but data theft through a USB flash drive is probably one of the easiest ways. USB devices are physically concealable and inexpensive. So while conducting a forensic investigation of how data was stolen, you will have to check the USB drive usage in your network.

PowerShell's Get-WMIObject reveals all USB devices connected to your network when queried with 'win32_diskdrive'. You can do this with ADAudit Plus's attractive graphical interface which provides a consolidated dashboard of all your AD reports. It provides special 'USB Storage Auditing' reports that track file activity like 'copy and paste', 'read', 'modified', and device plug-ins. The table below draws a comparison between detecting USB devices using PowerShell and ADAudit Plus.

Windows PowerShell

Steps to view connected USB drives with PowerShell

Run the 'Get-WMIObject' along with the 'win32_diskdrive' query.

Win32 is a disk drive a computer recognizes when it runs on the Windows Operating system.

Specify the 'Interface type'.


GET-WMIOBJECT win32_diskdrive | Where { $_.InterfaceType –eq ‘USB’ }

ADAudit Plus

Steps to view connected USB drives with ADAudit Plus

Login to ADAudit Plus web console with authorized credentials. Click on the 'Server Audit' tab and select 'USB Storage Auditing' from the left pane.

This gives you multiple reports on 'All File and Folder Changes', 'File read', "File Modified', 'File Copy and paste', 'Removable device plug-in'.

The reports provide detailed information about the file or folder accessed, the location of the change, who made the change and what modification was made.

You can also perform a filtered search by 'server', 'filter/folder name', 'location' 'modified by', and 'message'. These filters help you identify any particular event that you're looking for.


Why ADAudit Plus is a better solution to identify USB connected devices.

  • ADAudit Plus supports both 32 bit and 64 bit machines to provide multiple reports on removable storage devices.
  • Offers pre-configured reports on 'USB Storage Auditing'.
  • Additionally you have special IT Auditor logins that give only report viewing permissions.
  • Filter Attributes that help you identify specific events in the report.
  • Makes it easy for you to comply with various compliance laws like HIPAA, GLBA, SOX and many more.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By