Microsoft-Windows-TerminalServices-ClientUSBDevices
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 2 | message. | Debug | N | N |
| 3 | message. | Debug | N | N |
| 4 | message. | Analytic | N | N |
| 5 | message. | Analytic | N | N |
| 6 | message. | Debug | N | N |
| 7 | message. | Debug | N | N |
| 8 | message. | Analytic | N | N |
| 9 | message. | Analytic | N | N |
| 43 | Policy blocks user from using USB redirection. | Debug | N | N |
| 44 | USB port cycle failed | Debug | N | N |
| 45 | USB Diagnostic Mode is not set. | Debug | N | N |
| 46 | Device deviceName installation is blocked by policy. | Admin | N | N |
Event ID 43: Policy blocks user from using USB redirection.
#Event ID 44: USB port cycle failed
#Event ID 45: USB Diagnostic Mode is not set.
#Provenance
ETW provider GUID 6e400999-5b82-475f-b800-cef6fe361539
Defined in tsusbflt.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3037, captured 2026-06-02 — Manifest XML pack, 2.0 MB