Dear Rapidcare,

    Any new external device that is connected to a windows machine be it server or desktop/laptop is logged in eventlogs with the Event ID - 6416 A new external device was recognized by the system in source Security and source name "Microsoft Windows security auditing". With our Resource Checks you will be able to get alert of the specific event when it is logged. 

To configure the resource check for event log, goto any server monitoring in our client and edit it (Server tab > choose a server > far end click on the hamburger icon > edit). Under configuration profiles section you will find resource Check profile. Choose the existing profile or create a new one (select windows event logs). 

Give a check name, log name as Security, EventID as 6416 and source as "Microsoft Windows security auditing" and save it. Now when ever an external device is detected you will receive an alert and the status of your server will change to Trouble (you can change the default in Server's threshold profile).

Note: You can associate the same check to other server monitors by selecting the servers from Associate Server Monitors.

Try it and let us know if it works for you.

 -Jasper

Product Manager, Site24x7