Direct Inward Dialing: +1 408 916 9892
A Plug and Play device (PnP) is an umbrella term for any hardware device that can be automatically detected by a computer without the need for any configuration hardware like dip switches, or jumpers. Display monitors, mouse, keyboards, are PnP devices, along with USB flash drives, memory cards and hard drives. Monitoring PnP connected to your network is an important part of company audit requirements.
The 'Get-PnP' cmdlet in PowerShell retrieves a list of all PnP devices connected to your network. Based on the specified property, this cmdlet can retrieve a list of PnP devices according to present status, instance ID or device of a specified class.
A simpler approach to detect PnP devices would be to use the ADAudit Plus dashboard. ADAudit Plus allows you to easily find PnP related events using its 'Advanced Filter' option. The following comparison shows you how to get PnP devices with PowerShell and with ADAudit Plus and how ADAudit Plus simplifies the process.
Run the 'Get-PnP' cmdlet. Simply running this cmdlet would retrieve a list of PnP devices.
PS C:\>Get-PnpDevice
Appending various properties to the 'Get-Pnp' cmdlet can help you retrieve more specific results
PS C:\>Get-PnpDevice -InstanceId 'USB\VID_8087&PID_0024\5&3541780&0&1'
Appending a 'PresentOnly' property produces a list of present devices. You can also specify the status of the device as in the code below.
Code: PS C:\>Get-PnpDevice -PresentOnly -Status ERROR,DEGRADED,UNKNOWN
You can also retrieve a list of PnPs based on device class by using the ' Class' property.
Code: PS C:\>Get-PnpDevice -Class 'Keyboard'
Login to the ADAudit Plus web console with authorized credentials. Navigate to the 'Server Audit' and go to the 'USB Storage Auditing' tab on the left pane.
In the drop down list select the 'Remove Device Plug in' option.
In the 'Advanced Search' option, you can choose a variety of filter options to look for a specific device.