Find out what is causing add/remove hardware sound
If the device in question is Plug-n-Play (PnP) then you can enable auditing.
To configure locally using the group policy editor:
- Launch gpedit.msc
- Navigate to:
Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking.
Audit PnP Activity can then be enabled for success/failure.
The explanation for this option is as follows:
PNP Activity
This policy setting allows you to audit when plug and play detects an external device.
If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play.
Volume: Low
To view the logs, launch the Windows Event Log, e.g. eventvwr and open the Security event log.
If needed, from the command line you can check the state by running:
AuditPol /get /category:"Detailed Tracking"
To enable auditing of failure and success for Plug and Play Events:
AuditPol /set /subcategory:"Plug and Play Events" /failure:enable /success:enable
To disable:
AuditPol /set /subcategory:"Plug and Play Events" /failure:disable /success:disable