How to find the USB hardware ID using PowerShell and other tools

If you've ever plugged in a USB drive and your computer started acting strangely, or Windows displayed a mysterious error message, the problem is probably related to the USB device hardware identifier (Hardware ID)Knowing how to locate that ID using PowerShell and other built-in Windows tools is a skill that can save you a lot of headaches, especially in business environments where installing third-party software is not allowed.

Furthermore, it is mandatory in many companies control which USB devices are connected, register their IDs, and have traceability For security and regulatory compliance reasons. From preventing information leaks to blocking the entry of malware When dealing with an infected USB drive, the key is to properly identify each device. Here you'll see, in considerable detail, how the HWID works, how to obtain the USB ID using PowerShell and other tools, and how to use that information both to diagnose problems and to automate device tracking.

What is a Hardware ID (HWID) and why should you care?

El Hardware ID or HWID is a unique digital identifier associated with each physical component. of your computer: motherboard, hard drive, graphics card, network adapters, USB controllers, etc. It is often called the device's "fingerprint" because it serves to differentiate it from the rest even when two computers are seemingly identical.

On a typical PC, the operating system combines The HWIDs of several major components to build a global machine identityThat identity is crucial for things like software licenses that are tied to a specific computer, the tracking of IT assets and many security processes that need to ensure that a program only runs on authorized hardware.

This identifier wasn't invented by Windows for no reason: Each piece of hardware has its own ID recorded in the firmware (for example, in the device's EEPROM). The operating system reads it, and from that information generates identifier strings that then appear in Device Manager, PowerShell, or in commands , the WMIC.

When you install the operating system for the first time, Windows takes a snapshot of that hardware configuration and generates a set of identifiers linked to that machine. If you later change something major, like a motherboard, the set of HWIDs can change enough to trigger license verification again or even require system reactivation in some products.

How to build a USB device identifier

In the case of USB devices, the HWID is derived from a very specific descriptor: the USB device descriptor (USB_DEVICE_DESCRIPTOR)It is a data structure that every USB device must provide and that describes its basic characteristics: class, supported USB version, manufacturer, product, etc.

Within that descriptor there are two key fields: idVendor and idProductThe first identifies the manufacturer (Vendor ID or VID), and the second the specific product model (Product ID or PID). Windows uses these values ​​to construct strings like USB\VID_XXXX&PID_YYYY… which you then see as “Hardware Ids” in Device Manager.

For example, a Microsoft USB webcam might have something like idVendor = 0x045E (Microsoft) and idProduct = 0x0728. That pair of values, along with the device version number (bcdDevice) and other fields, combine to form the hardware IDs and compatible IDs with which Windows matches the correct driver.

Field bcdUSB The descriptor indicates the version of the USB specification to which the device conforms (for example, 0x0200 for USB 2.0). This helps the USB driver stack know how to communicate with the device, what speeds it supports, and what configuration options are available.

An important detail is that A USB device should not change its descriptor information while it is connectednot even when it changes power state. What can happen is that it displays different information depending on whether it's connected at high speed versus full speed, but that's decided at the time of connection.

From the controller side, the host obtains this descriptor through a GET_DESCRIPTOR control transfer directed to the deviceIn Windows, kernel-mode drivers (KMDF/UMDF/WDM) can formally request that descriptor through URBs (USB request blocks) or framework APIs, but that's already driver development territory, not administration via PowerShell.

View the USB Hardware ID using Windows graphical tools

Before we delve into PowerShell, it's worth remembering that Windows offers several very straightforward graphical ways to view the HWIDs of any deviceThey are especially useful when you only need to identify a specific device.

1. Device Manager

The fastest way, without writing a single line of code, is to use the Windows Device ManagerIt is compatible with any type of hardware, including USB devices. storageprinters, webcams, etc.

• Open Device Manager by pressing Win + X and selecting “Device Manager”, or by searching for “devmgmt.msc”.
• Locate the component, for example in “Universal Serial Bus Controllers” or “Disk Drives” if it's a USB drive.
• Right-click on the problematic device and enter Properties.
• Go to the tab Details.
• In the “Property” dropdown menu, select Hardware IDs.

You'll see a list of strings; the most specific one usually includes VID, PID, and sometimes the serial number or SUBSYS. These are the strings you can then use in scripts or driver searches, copying them exactly as they are.

2. Command Prompt with WMIC

If you prefer a console option but don't want to touch PowerShell yet, you can use WMIC (It's deprecated in modern versions, but you'll still find it on many computers):

wmic path win32_pnpentity get name, deviceid

This command shows all Plug and Play devices and their DeviceIDThese are precisely the hardware IDs we're interested in. You can then filter them visually or export the output to a file for processing.

3. Third-party applications (when permitted)

In environments where it is permitted, it is common to use tools such as CPU-Z, Speccy or HWiNFO to obtain a complete system X-ray, including HWID of many components. However, in many companies that option is prohibited, so PowerShell becomes the Swiss Army knife accepted by security policies.

Obtain the USB hardware ID from PowerShell

PowerShell includes very powerful cmdlets for viewing and filtering information about Plug and Play devices. For HWID purposes, the most interesting one is... Get-PnpDevicealthough older WMI classes are still used in some legacy scripts.

List hardware IDs with Get-PnpDevice

To view the identifiers of all active devices on the system, you can use:

Get-PnpDevice -PresentOnly | Select-Object -Property Name,InstanceId

This command returns a table with the device's friendly name and its InstanceIdThat InstanceId is precisely the hardware ID string (or very close to it) that you can then relate to errors, system events, or driver searches.

If you want to focus only on PCI devicesFor example, you could filter with:

Get-PnpDevice | Where-Object { $_.InstanceId -match '^PCI' } | Select-Object FriendlyName, InstanceId

And for USB devices, you can use a similar filter on the InstanceId string, changing the prefix:

Get-PnpDevice | Where-Object { $_.InstanceId -like 'USB\VID_*' } | Select-Object FriendlyName, InstanceId

Real-life cases: Identifying a problematic USB drive by its ID

A very common scenario is the following: Your PC freezes, you check the Event Viewer and find a reference to a device like "USB\VID_1F75&PID_0917\8&31abfd78&0&3"You go through Device Manager looking for that ID and there's no way to know what it is exactly.

Practical example: In these situations, it's very useful to use PowerShell to cross-reference the information. For example, you can try to locate any PnP device whose InstanceId starts with that pattern:

Get-PnpDevice -InstanceId 'USB\VID_1F75*'

If this returns nothing (sometimes this happens if the device is no longer connected), you can check the USB device history using WMI or, when permitted, with tools such as USBDeview which show all devices that have ever connected, including dates and ports.

View properties: If you get results, you can expand them with:

Get-PnpDevice -InstanceId 'USB\VID_1F75*' | Get-PnpDeviceProperty

This should list all PnP properties associated with the deviceHowever, if the device is not present or there is a permissions issue, you might receive empty or partial results. To export the information to a CSV file, the idea would be:

Get-PnpDevice -InstanceId 'USB\VID_1F75*' | Get-PnpDeviceProperty | Export-Csv -Path 'DevDetails.csv' -NoTypeInformation

If the CSV file appears empty, it almost always means that no device matches the filter at that time or that the cmdlet could not read the properties (due to permissions or because the device is not responding).

View USB storage devices connected with WMI

Another typical case is wanting to know What USB drives or flash drives are currently connected?A classic shortcut in PowerShell is to rely on the WMI class. Win32_DiskDrive Filtering by interface type:

Get-WmiObject Win32_DiskDrive | Where-Object { $_.InterfaceType -eq 'USB' }

If you want something more readable and exportable, you can project only the relevant fields using a PSCustomObject:

Get-WmiObject Win32_DiskDrive | Where-Object { $_.InterfaceType -eq 'USB' } | ForEach-Object {
[PSCustomObject]@{
DeviceID = $_.DeviceID
Model = $_.Model
Serial = (Get-WmiObject Win32_PhysicalMedia | Where-Object { $_.Tag -eq $_.DeviceID }).SerialNumber
}
}

Here, each custom object displays the device identifier, model, and physical serial number (when the manufacturer displays it correctly). This is a very useful basis for inventory and tracking scripts.

Automatically monitor and log USB devices with PowerShell

In corporate environments, it is very common for the IT department to want a centralized registry of all connected USB devices for each machine: what device it was, when it connected, from which computer, etc. This helps detect unauthorized devices, investigate security incidents, and comply with internal policies.

A flexible way to do this without additional licenses is to mount un script A PowerShell script that collects relevant information from each USB device and sends it to a central server via a REST APIBased on the previous example with WMI, the scheme would look something like this:

Get-WmiObject Win32_DiskDrive | Where-Object { $_.InterfaceType -eq “USB” } | ForEach-Object {
[PSCustomObject]@{
DeviceID = $_.DeviceID
Model = $_.Model
Serial = (Get-WmiObject Win32_PhysicalMedia | Where-Object { $_.Tag -eq $_.DeviceID }).SerialNumber
}
} | ConvertTo-Json | Invoke-RestMethod -Uri «http://servidorcentral/api/usblog» -Method Post

This block It collects all disks with a USB interface, prepares objects with the key data, and serializes them to JSON.Then, with Invoke-RestMethodSend that JSON to an HTTP endpoint on your logging server. From there, your imagination (and security requirements) take over: you can add the team name, session user, exact date and time, etc.

For continuous monitoring, the script is usually combined with the Windows Task Scheduler to run at system startup or login, or you can create a service that monitors system events related to USB connections and triggers real-time transmission.

Create a simple REST API to log USB data

To receive the data sent by the PowerShell script, you need a small Web server with a route prepared to accept POST requests with JSONA very quick way to do this is by using Python with Flaskwhich allows you to set up an endpoint with few lines.

The basic idea is this:

from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/usblog', methods=['POST'])
def log_usb_data():
data = request.get_json()
if not data:
return jsonify({"error": "No data sent"}), 400
with open("usb_log.txt", "a") as log_file:
log_file.write(f»{data}\n»)
return jsonify({"message": "Data received successfully"}), 200
if __name__ =='__main__':
app.run(host='0.0.0.0′, port=5000)

With this, every call from your PowerShell scripts will end adding a line with the USB device data to the usb_log.txt fileObviously, in a real deployment you'll want to send that data to a database, add authentication, encrypt traffic with HTTPS, etc., but as a starting point it's more than enough.

Requirements: The basic steps to get it up and running would be:

• Install Flask with pip install flask on your Python server.
• Save the code in a server.py and launch it with python server.py.
• Configure the URL in PowerShell scripts to point to http://IP_DEL_SERVIDOR:5000/api/usblog.

From that point on, any device that has permission to contact that server will be able to submit your inventory of USB devices periodically or on demand.

Schedule USB scripts to run at Windows startup

For this whole system to be practical, it is important that The PowerShell script will launch automatically without anyone having to remember to run it.Windows offers two commonly used methods: Task Scheduler and Startup folder.

Using Task Scheduler

Quick setup: With the Task Scheduler (Task SchedulerYou can configure execution in response to different system events:

• Open Task Scheduler and choose “Create task”.
• On the “General” tab, give a name like “USB Tracking” and select “Run with the highest privileges”.
• In “Triggers”, he adds one for “When the system starts” or “When I log in”, depending on what interests you.
• In “Actions”, select “Start a program” and point to powershell.exe with parameters type -NoProfile -ExecutionPolicy Bypass -File «C:\path\script.ps1».
• Save and verify that the task is enabled.

This ensures that Monitoring starts every time the equipment is started and that the script can access all the necessary information, provided it has the appropriate permissions.

Using the Home folder with a .bat file

Another simpler, though less granular, option is to create a '.bat' that calls PowerShell and places it in the user's Home folder:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File «C:\path\del\script.ps1»

You save that as, for example, tracking_usb.batand copy it to:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

As soon as the user logs in, Windows will run that .bat file and, with it, the PowerShell script.It's a useful solution for small environments or when you don't want to deal with the Task Scheduler.

Track USB devices on remote computers using PowerShell

In many corporate networks, the problem isn't just knowing which USB drive connects to your own computer, but to have a global view of connected devices across multiple computersWhen third-party agents cannot be used, the combination of PowerShell Remoting and WMI remains a very valid approach.

A typical example of a script to list USB devices on multiple computers would look something like this:

$computer = «COMPUTER1″,»COMPUTER2″,»COMPUTER3»
$namespace = "root\CIMV2"
Get-WmiObject -Class Win32_USBControllerDevice -ComputerName $computer -Namespace $namespace |
ForEach-Object { [wmi]($_.Dependent) } |
Sort-Object Manufacturer,Description,DeviceID |
Format-Table -GroupBy Manufacturer Description,Service,DeviceID |
Out-File -Append -FilePath C:\USB\usblist.txt

The idea is: query the USB controller-device relationship on each remote computer, resolve the Dependent property to an actual WMI instance, and then dump the sorted information to a text fileIf the file remains empty, you need to check permissions, remote accessibility, firewall and, of course, the script syntax (spaces or poorly closed quotes are a classic).

With a good structure of this type of script, you can achieve a consolidated inventory of USB devices per teamgrouped by manufacturer and description, without depending on third-party software.

Using USB ID to find and maintain drivers

Beyond the security aspect, knowing and managing the Hardware ID is key to finding suitable driversespecially when Windows fails to find the generic version or after a system update that leaves a device "dead".

Hierarchical pattern: IDs of this type usually follow a hierarchical pattern, especially in PCI/PCIe devices:

• VEN_XXXX Identify the chip manufacturer.
• DEV_XXXX Indicate the specific model of the device.
• SUBSYS_XXXXXXXXX details assembler variants, region, etc.

For USB, we find chains like USB\VID_XXXX&PID_YYYY and sometimes with the serial number. When a device stops working after a Windows update, Copy the exact HWID and enter it into the manufacturer's search engine or in databases Specialty It's a very accurate way to find the right driver, even for older hardware.

Tools like Snappy Driver Installer Origin Commercial controller management solutions often rely precisely on these identifiers for pair device-driver preciselyThere are also local search engines capable of searching through hundreds of .inf files using the HWIDs embedded within them, which is great when you have a library of downloaded drivers but can't remember which one corresponds to what.

A useful trick for the most organized people is Maintain a spreadsheet with columns for VEN, DEV, SUBSYS, description, and driver pathWith functions like MID() in Excel you can automatically extract those fields from the HWID string, and in the long run that saves you many hours of trial and error when dealing with poorly documented hardware.

Complementary tools for working with USB IDs

Although the focus here is on what you can do with PowerShell and Windows built-in utilitiesIt is useful to know some auxiliary tools —especially if your environment allows their installation— that facilitate working with USB devices.

USB Device Viewer (USBView) from Microsoft

Microsoft offers the utility for free. USB Device Viewer (USBView), included in the Windows Driver Kit. It provides a tree view of all USB drivers and devices present in the system, and displays idVendor, idProduct and other device descriptor fields in a very clear way.

Steps: The basic steps are:

• Install the corresponding Windows Driver Kit package and locate USBView.exe (usually in the debuggers path, for example, Debuggers\x64).
• Run it and select the USB device in the tree on the left.
• Check the fields in the right panel idVendor and idProduct, along with the rest of the descriptor.

If you are developing drivers, for example with VISA Driver Development WizardThis data is essential to tell the driver which devices to handle based on their VID and PID.

Online USB ID databases

When you don't physically have the device on hand but you know its name or part of its identifier, you can also resort to public USB ID databasesOn these types of sites you can search by model, brand or even by VID/PID fragments, and they return the official values ​​of Vendor ID and Product ID registered for that device.

This is especially useful when You have a partial HWID, or Windows only gives a generic description.and you need to confirm which VID/PID it corresponds to before searching for a compatible driver or applying a device blocking policy by ID.

Ultimately, being fluent in USB IDs and other hardware identifiers turns you into a kind of "system detective": You can trace which device caused a crash, which USB drive was connected to which computer and when, or why a driver has stopped loading after an updateWith PowerShell as the central tool, combined with Device Manager, WMI, some specialized utilities, and, if necessary, a small Flask server, you have everything you need to monitor and control the USB ecosystem of your environment without relying on cumbersome third-party solutions or unreliable assumptions.