How to view log of hardware removal and connection?

Question

Short Version

In Windows 10 how do i get a log of hardware that is removed and connected?

Long Version

I get the Windows Disconnect about every 3-5 seconds.

Obviously Windows knows that some hardware has disconnected; it's playing the sound!

I need to know what hardware. (e.g. what PCI hub? what SATA port? what USB port? what LCP port?)

I need the log that Windows must have.

Things that don't work

• Logging when someone connects or removes a USB device to/from a Windows machine

• Windows adding/removing hardware - how to identify?

• NirSoft USBLogView

• Enabling the Microsoft/Windows/DriverFrameworks-UserMode/Operational log:

  

• Using the Last Hour view in the Event Log:

  

• Disabling USB power selective suspend option

Bonus: Not all hardware is a USB device, USB port, or USB hub

Answer 1

Your problem sound a bit strange, which is probably why nobody answered. But there are a few places that come to mind, where you may want to look. It's all in the registry, but it's hard to extract without proper forensic software. The simplest ways are these.

1. Open (admin) PowerShell and try to modify the queries to suit your purpose:

$Path = 'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*'
Get-ItemProperty -Path $Path | Select-Object -Property FriendlyName, CompatibleIDs, Mfg  

2. Look in the C:\Windows\inf\setupapi.dev.log. For example, using Cygwin:

less /cygdrive/c/Windows/Inf/setupapi.dev.log

More information on the log file can be found here. Specifically, if you set the DWORD to 00007070 in the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel 

you get very verbose log.

Answer 2

The comment above was the answer: EventGhost.