This article will detail how to make and apply the script to check for USB flash drives connected to devices.
- Open Notepad and paste this Script:
$usb_size = @{ Name = 'Size';Expression = { [Math]::Round( ($_.Size/1073741824), 2) } }
$usb_drives = Get-Disk | Where-Object -FilterScript { $_.Bustype -Eq "USB"} | FL -Property Model,SerialNumber,$usb_size | Out-StringIF (!($usb_drives -ieq $null)){
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("X-API-KEY", 'YOUR_API_KEY_HERE')$Dguid = (Invoke-RestMethod "https://app.atera.com/api/v3/agents/machine/$ENV:COMPUTERNAME" -Headers $headers).Items.DeviceGuid
$Cid = (Invoke-RestMethod "https://app.atera.com/api/v3/agents/machine/$ENV:COMPUTERNAME" -Headers $headers).Items.CustomerID$Body = @{
DeviceGuid = $Dguid
CustomerID = $Cid
Title = "USB Drives - $(Get-Date -Format g)"
MessageTemplate = "$usb_drives GB"
Severity = "Information"
AlertCategoryID = "General"
Code = 1
}Invoke-RestMethod -Method Post 'https://app.atera.com/api/v3/alerts' -Headers $headers -Body $Body
}
exit - In the Atera UI, navigate to Admin > API. Click the view and copy buttons to copy the API key.
- Paste this API key where it says YOUR_API_KEY_HERE within the quotes.
- Save your script with the suffix .PS1
Set up your PC to Run the Script
- In your PC's start menu, open the Event Viewer.
- Navigate to Applications and Service Logs > Microsoft > Windows > DriverFrameworks-UserMode and click to view Operational.
- Click Enable Log. This will start the logging whenever somebody puts a USB flash drive into the PC.
Now that logging is enabled you will need to create a Scheduled Task to run the script every time that the event is created.
- In your PC's start menu, open the Task Scheduler.
- Click on the Task Scheduler Library and select Create Task on the right side.
- Fill out the General tab with the name of this new task.
- Click the Triggers tab. Click New. And in the drop down list Begin the Task, select On an Event and choose Custom.
- Click New Event Filter.
- Have Logged set to Any Time. Click By Log and navigate to Microsoft-Windows-DriverFrameworks-UserMode/Operational. In the ID field, add 1003.
- Click OK in both the Triggers and the General tabs.
- Next, click on the Actions tab. Click New. In the program field, type Powershell.exe. In the Add Arguments box, add
-windowstyle hidden 'C:\Scripts\USB_Alert.ps1’ with the location to your script.
- Enter any Conditions and Settings that you require and click OK to create the Scheduled Task.
Verify the Script
- Insert a USB drive into the computer.
- Navigate to that device in the Atera Portal.
- You will see an alert for every time a USB drive is inserted.