PNP Events

Description: When a Plug and Play driver install is attempted, the service will log an ID 20001 event and provide a Status within the event. It is important to note that this event will trigger for any Plug and Play-capable device, including but not limited to USB, Firewire, and PCMCIA devices.

Location:

• C:\Windows\System32\winevt\logs\System.evtx

Notes: Event ID: 20001 - Plug and Play driver install attempted:

• Timestamp
• Device Information
• Device Serial Number
• Status (0 = No Errors)

Analysis:
Coming Soon!