Forum Discussion
Device control removable storage via GPO - where to find logs
You can use advanced hunting for it. Query:
DeviceEvents
| where DeviceName contains "hostname"
| where ActionType contains "Pnp"
OR
DeviceEvents
| where DeviceName contains "hostname"
| where ActionType == "PnpDeviceConnected" and Timestamp > ago(7d)
| extend ClassName = parse_json(AdditionalFields).ClassName
| extend DeviceId = parse_json(AdditionalFields).DeviceId
| extend VendorIds = parse_json(AdditionalFields).VendorIds
| extend DeviceDescription = parse_json(AdditionalFields).DeviceDescription
| project ClassName, DeviceDescription, Timestamp, DeviceId, VendorIds, DeviceName
| where ClassName contains "drive" or ClassName contains "usb"
change "ago(7d)" value with how many days you want to go back.
Also you can check Security Event ID 6416 in EventViewer.