I got a Win Server 2008 R2 on a VM. I think someone accidentally ejected the NIC card that is presented as a hot pluggable device. But I am trying to find proof of that in the windows event logs and I haven't found a thing so far. What should I be looking for?
EDIT for clarity:
- VMware presents NIC cards and HDDs to the Win Srv 2003 and newer VM as hot removable devices. This means if someone doesn't look where they are clicking can easily eject the NIC card, and this activity would not get logged in the VMware normal log messages. As per KB below, it has the fix as well:
The pluggin and unpluggin of hot plugging of removable devices are not logged apparently.
The VM is already fixed. I have the above as a theory as to what happened, but it wouldn't be a very convincing theory without sufficient proof. While I have the screenshot that shows the NIC is presented as a removable device that is circumstantial. I would rather have a log message that shows at "time xx:xx device removed".