Starting scheduled task by detecting connection of USB device

Solution 1:

The thread Task Scheduler: How to automatically synchronize my USB flash drive? has this answer by a user called monotone, which uses PowerShell together with the Task Scheduler :

I had the same question as you, and worked out something with powershell (windows built-in scripting) using techniques from the Scripting Guy Blog here and here. The script runs continuously as a background process, which you can start at system logon with task scheduler. The script will be notified whenever a new drive is plugged and then do something (here you configure the script rather than the task). Since it is basically paused while waiting for the next plugged drive, you should not find it takes up much resources. Here I go:

1) Start Powershell ISE, which can be found in your start menu under Accessories/Windows Powershell. 2) Copy paste the following into Powershell:

#Requires -version 2.0
Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange
write-host (get-date -format s) " Beginning script..."
do{
$newEvent = Wait-Event -SourceIdentifier volumeChange
$eventType = $newEvent.SourceEventArgs.NewEvent.EventType
$eventTypeName = switch($eventType)
{
1 {"Configuration changed"}
2 {"Device arrival"}
3 {"Device removal"}
4 {"docking"}
}
write-host (get-date -format s) " Event detected = " $eventTypeName
if ($eventType -eq 2)
{
$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName
$driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName
write-host (get-date -format s) " Drive name = " $driveLetter
write-host (get-date -format s) " Drive label = " $driveLabel
# Execute process if drive matches specified condition(s)
if ($driveLetter -eq 'Z:' -and $driveLabel -eq 'Mirror')
{
write-host (get-date -format s) " Starting task in 3 seconds..."
start-sleep -seconds 3
start-process "Z:\sync.bat"
}
}
Remove-Event -SourceIdentifier volumeChange
} while (1-eq1) #Loop until next event
Unregister-Event -SourceIdentifier volumeChange

3) You need to modify the script above to tell the script what drive to look for, and what to execute. The two lines to change are:

if ($driveLetter -eq 'Z:' -and $driveLabel -eq 'Mirror')

My usb hard drive named 'Mirror' is set as the Z: drive. You could just use if ($driveLabel -eq 'MyDiskLabel') if you didn't care about the letter.

start-process "Z:\sync.bat"

Path of whatever task you want to do. In my example, I have created a batch file on my USB drive which starts 3-4 backup tasks command lines.

4) When you're done, save your script somewhere (extension .ps1), then go create a task in Task Scheduler to have your script run in background. Mine looks like this:

• Trigger: At log on
• Action: Start a program
• Program/script: powershell
• Add arguments: -ExecutionPolicy Unrestricted -File "D:\Stuff\Backup script.ps1"

5) Voilà!

6) Extra stuff:

If you want your script window to be hidden, use these arguments:

• Add arguments:
  -WindowStyle Hidden -ExecutionPolicy Unrestricted -File "D:\Stuff\Backup script.ps1"

If you want to output the script messages into a log file (that gets overwritten everytime the script starts, i.e. at log on), use the following task action:

• Program/script: cmd
• Add arguments:
  /c powershell -WindowStyle Hidden -ExecutionPolicy Unrestricted -File "D:\Stuff\Backup script.ps1" > "D:\Stuff\script log.txt"

Anytime you want to end the running hidden script, you can end the "Powershell" process in Task Manager.

The only downside is that nothing will run when you boot your computer with the drive already plugged in. (The script could be changed to perform a first check initially though, but I've had enough for today!)

Solution 2:

As I already explained on this discussion (but it was about running a program when a USB drive is removed), USB Safely Remove, although not free, can run a program when some events about USB devices are triggered:

Another USB Safely Remove feature that distinguishes it from similar software is starting any applications not only after connecting a device, but also before removing it. The autorun feature allows you to set up data backup before disconnecting a removable hard drive, to run Total Commander with the contents of the pen-drive, automatically unmount an encrypted TrueCrypt drive before disconnecting the USB media, etc.

Of course, this does not fully answer the question, as it is not about using scheduled tasks, but the goal is the same, I think, which is to run a specific program when a USB stick is plugged in.

Solution 3:

It should be quite easy using EventVwr.

1. Find the event you want - When I plugged an USB mass storage device it triggered the following events (under application category): 20001, 20003, 7036 and a few other less relevant. Make sure you test those events against other USB devices events to avoid false positives.

2. right click on the event and click "Attach task to this event" (relevant only in Windows Vista or higher - for XP there's CLI EventTrigger), choose "Start a Program" and point it to the script you want to run.

3. To pass to the script the event parameters you need have a look in this article. Under the events 20001 and 20003 you can find the UNC path to the new storage. Using Sysinternals Junction utility you can create a links to the UNC paths.

Solution 4:

I was able to get this to work: I found event 1003 in applications and services logs, Microsoft-Windows-DriverFrameworks-UserMode for a phone plugged in to usb

Full xml of the event:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}" /> 
  <EventID>1003</EventID> 
  <Version>1</Version> 
  <Level>4</Level> 
  <Task>17</Task> 
  <Opcode>1</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2016-08-19T01:42:06.292278900Z" /> 
  <EventRecordID>17516</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="456" ThreadID="2932" /> 
  <Channel>Microsoft-Windows-DriverFrameworks-UserMode/Operational</Channel> 
  <Computer>XXXX</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <UserData>
- <UMDFDriverManagerHostCreateStart lifetime="{AFEC92AD-6015-4AB4-86AE-F34CEE06A977}" xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
  <HostGuid>{193a1820-d9ac-4997-8c55-be817523f6aa}</HostGuid> 
  <DeviceInstanceId>USB.VID_04E8&PID_6860&MS_COMP_MTP&SAMSUNG_ANDROID.6&3400EB54&1&0000</DeviceInstanceId> 
  </UMDFDriverManagerHostCreateStart>
  </UserData>
  </Event>

And the custom event filter for my task:

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">
    <Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">*[System[Provider[@Name='Microsoft-Windows-DriverFrameworks-UserMode'] and EventID=1003]] and *[UserData[UMDFDriverManagerHostCreateStart[DeviceInstanceId="USB.VID_04E8&amp;PID_6860&amp;MS_COMP_MTP&amp;SAMSUNG_ANDROID.6&amp;3400EB54&amp;1&amp;0000"]]]</Select>
  </Query>
</QueryList>

Similarly for a USB drive it was event 2100, 2101, 2105, 2106
For a specific USB Drive:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-DriverFrameworks-UserMode" Guid="{2E35AAEB-857F-4BEB-A418-2E6C0E54D988}" /> 
  <EventID>2101</EventID> 
  <Version>1</Version> 
  <Level>4</Level> 
  <Task>37</Task> 
  <Opcode>2</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2016-08-19T01:52:37.922289600Z" /> 
  <EventRecordID>17662</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="10956" ThreadID="11892" /> 
  <Channel>Microsoft-Windows-DriverFrameworks-UserMode/Operational</Channel> 
  <Computer>XXXX</Computer> 
  <Security UserID="S-1-5-19" /> 
  </System>
- <UserData>
- <UMDFHostDeviceRequest instance="WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_SANDISK&PROD_SANDISK_CRUZER&REV_8.02#0774230A28933B7E&0#" lifetime="{4493DBFB-81E8-4277-933D-955C4DDDD482}" xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/DriverFrameworks/UserMode/Event">
- <Request major="27" minor="20">
  <Argument>0x0</Argument> 
  <Argument>0x141b</Argument> 
  <Argument>0x0</Argument> 
  <Argument>0x0</Argument> 
  </Request>
  <Status>0</Status> 
  </UMDFHostDeviceRequest>
  </UserData>
  </Event>

It looks like event 2101 happens 3 times with slightly different "<request>" tags when I plug in my usb drive:

<Request major="27" minor="20">
<Request major="27" minor="9">
<Request major="27" minor="0">

I have no idea what this means but here is a filter for only one of them to avoid multiple triggers: (this will only trigger for this specific USB drive)

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">
    <Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">*[System[Provider[@Name='Microsoft-Windows-DriverFrameworks-UserMode'] and  EventID=2101]] and *[UserData[UMDFHostDeviceRequest[@instance="WPDBUSENUMROOT\UMB\2&amp;37C186B&amp;0&amp;STORAGE#VOLUME#_??_USBSTOR#DISK&amp;VEN_SANDISK&amp;PROD_SANDISK_CRUZER&amp;REV_8.02#0774230A28933B7E&amp;0#" and Request[@major="27" and @minor="20"]]]]</Select>
  </Query>
</QueryList>

Note that the ampersands must be escaped as &