You can use the EventSentry Hardware Inventory to track USB storage devices using the following EventSentry Event IDs: 12040: A 1 drive has been added. 12041: A 1 drive has been removed. Where 1 represents the device interface: Steps 1 Verify that the Hardware Inventory package under System Health is enabled ...
KB-ID 554
Category: Monitoring