Endpoint Standard: How to Determine USB Hardware IDs for Device Control?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to Determine USB Hardware IDs?

Environment

•    Endpoint Standard Web Console: November '20 Release (0.60) and Higher
•    Carbon Black Cloud Windows Sensor: 3.6.0.1897 and Higher

Resolution

In Windows Device Manager:

1. Open “Device Manager”
2. Expand “Disk Drives” and find your USB drive
3. Right click on your USB drive and select “Properties”
4. Select the “Details” tab
5. Choose “Parent” from the dropdown
6. The detail under “Parent” should look something like the following: USB\VID_0781&PID_5599\4C530000151222113371
7. Retrieve VendorID, ProductID, and Serial Number for the desired device. The values are represented in the following manner:

• USB\VID_VENDORID&PID_PRODUCTID\SERIALNUMBER

In Powershell:

1. Open “Windows PowerShell”
2. Run the following PowerShell command: ((Get-CimInstance -Class win32_PnPSignedDriver) | ?{($_.Description -like '*mass*')}) |Select Description, DeviceClass, DeviceID, Manufacturer

• Retrieve VendorID, ProductID, and Serial Number for the desired device from the command output. The values are represented in the DeviceID column as follows: USB\VID_VENDORID&PID_PRODUCTID\SERIALNUMBER