Logging when someone connects or removes a USB device to/from a Windows machine

Connecting and disconnecting of USB devices is logged in the "Event Log".

Quoting this detailed description ("Digital Forensics Stream" blog, 2014-01-02, The Windows 7 Event Log and USB Device Tracking):

Connection Event IDs
When a USB removable storage device is connected to a Windows 7 system, a number of event records should be generated in the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log. The records include those with Event ID 2003, 2004, 2005, 2010, 2100, 2105, and more. ...

Disconnection Event IDs
When a USB thumb drive is disconnected from a Windows 7 system, a few event records should be generated in the same event log as the connection events. Records with Event ID 2100, 2102, and potentially more may be generated when a USB device is disconnected. ...

For automating exports from the Event Log, Microsoft offers the logparser for free.


There are paid solutions for that eg. EndProtection4 by CoSoSys. No idea how that works inside the agent installed on the device but it gives you all information on devices plugged in. You need a server side that manages the clients as this is the software that manages access to devices. Works on Macs and Linux as well.