is there any relevance to determine when device drivers are installed on a system. Particularly in a readable format.
Do you mean which drivers or do you mean date they were installed ?
Those definitely are different
If its just which ones then look at https://developer.bigfix.com/relevance/reference/service.html#driver-service-service
For instance if someone tries to connect a blue tooth device or an external usb drive. Can I identify if the driver associated to those devices are installed?
Unless I’m mistaken, the “driver services” inspector won’t enumerate individual devices. If you’re looking for devices that have been connected (but might not be connected right now), you can probably enumerate through HKLM\System\CurrentControlSet\Control\Class to see individual device instances.
q: pathnames of keys whose (name of it != "Properties") of keys of keys "HKLM\System\CurrentControlSet\Control\Class" of native registry
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0000
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0001
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0002
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0003
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0004
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0005
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0006
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0007
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0008
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0009
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0010
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0011
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0012
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0013
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0014
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0015
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}\0016
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\0000
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E966-E325-11CE-BFC1-08002BE10318}\0000
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\0000
A: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\0001
You can decide which properties you want to retrieve from those keys…have a look at the registry data to see what values you’re interested in retrieving, but you might start with something like
q: (value "DriverDesc" of it as string | "<no driverdesc>", value "MatchingDeviceId" of it as string | "<no deviceid>", value "infPath" of it as string |"<no infpath>", value "DriverVersion" of it as string | "<no driverversion>", value "MatchingDeviceID" of it as string | "<no MatchingDeviceID>") of keys whose (name of it != "Properties") of keys of keys "HKLM\System\CurrentControlSet\Control\Class" of native registry
A: Standard Enhanced PCI to USB Host Controller, pci\cc_0c0320, usbport.inf, 6.1.7601.23403, pci\cc_0c0320
A: Standard Enhanced PCI to USB Host Controller, pci\cc_0c0320, usbport.inf, 6.1.7601.23403, pci\cc_0c0320
A: Texas Instruments XHCI Controller, pci\ven_104c&dev_8241, oem9.inf, 1.12.24.0, pci\ven_104c&dev_8241
A: USB Root Hub, usb\root_hub20, usbport.inf, 6.1.7601.23403, usb\root_hub20
A: USB Root Hub, usb\root_hub20, usbport.inf, 6.1.7601.23403, usb\root_hub20
A: Texas Instruments USB Root Hub, usb\tiusbd_hub&vid_040e&pid_0100, oem10.inf, 1.12.24.0, usb\tiusbd_hub&vid_040e&pid_0100
A: Generic USB Hub, usb\class_09, usb.inf, 6.1.7601.23403, usb\class_09
A: Generic USB Hub, usb\class_09, usb.inf, 6.1.7601.23403, usb\class_09
A: USB Composite Device, usb\composite, usb.inf, 6.1.7601.23403, usb\composite
A: USB Composite Device, usb\composite, usb.inf, 6.1.7601.23403, usb\composite
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
You can also filter by ClassGUID. If you’re only interested in USB Storage devices and BlueTooth devices,
q: (value "DriverDesc" of it as string | "<no driverdesc>", value "MatchingDeviceId" of it as string | "<no deviceid>", value "infPath" of it as string |"<no infpath>", value "DriverVersion" of it as string | "<no driverversion>", value "MatchingDeviceID" of it as string | "<no MatchingDeviceID>") of keys whose (name of it != "Properties") of keys ("{36FC9E60-C465-11CF-8056-444553540000}";"{E0CBF06C-CD8B-4647-BB8A-263B43F0F974}") of keys "HKLM\System\CurrentControlSet\Control\Class" of native registry
A: Standard Enhanced PCI to USB Host Controller, pci\cc_0c0320, usbport.inf, 6.1.7601.23403, pci\cc_0c0320
A: Standard Enhanced PCI to USB Host Controller, pci\cc_0c0320, usbport.inf, 6.1.7601.23403, pci\cc_0c0320
A: Texas Instruments XHCI Controller, pci\ven_104c&dev_8241, oem9.inf, 1.12.24.0, pci\ven_104c&dev_8241
A: USB Root Hub, usb\root_hub20, usbport.inf, 6.1.7601.23403, usb\root_hub20
A: USB Root Hub, usb\root_hub20, usbport.inf, 6.1.7601.23403, usb\root_hub20
A: Texas Instruments USB Root Hub, usb\tiusbd_hub&vid_040e&pid_0100, oem10.inf, 1.12.24.0, usb\tiusbd_hub&vid_040e&pid_0100
A: Generic USB Hub, usb\class_09, usb.inf, 6.1.7601.23403, usb\class_09
A: Generic USB Hub, usb\class_09, usb.inf, 6.1.7601.23403, usb\class_09
A: USB Composite Device, usb\composite, usb.inf, 6.1.7601.23403, usb\composite
A: USB Composite Device, usb\composite, usb.inf, 6.1.7601.23403, usb\composite
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
A: USB Mass Storage Device, usb\class_08&subclass_06&prot_50, usbstor.inf, 6.1.7601.23403, usb\class_08&subclass_06&prot_50
T: 1.754 ms
I: plural ( string, string, string, string, string )