I am writing a script that uses MS KB 823732 to temporarily prevent users from plugging in new USB storage devices. This works fine, and the
HKLM\...\Services\UsbStor registry key successfully blocks newly-connected devices from being accessed.
Is there a WMI event that will tell me that a drive was connected, regardless of whether it was mounted?
I tried querying for
__InstanceCreationEvent but that is apparently raised only after the drive is mounted and made available, which doesn't fit my requirements.