How to Find Hidden USB Devices in Windows Using Device Manager, USBDeview, and PowerShell

The fastest way to find hidden USB devices in Windows is to check Device Manager first, then confirm old USB records with USBDeview or PowerShell. Windows keeps records for devices that were connected before, even when they are unplugged, and Device Manager can show non-present hardware when hidden devices are enabled [source: Microsoft]. This helps an administrator spot old flash drives, ghost printers, USB network adapters, phones, and storage devices that no longer appear in File Explorer.

TLDR: Device Manager is best for a quick visual check, USBDeview is better for USB history, and PowerShell is best when the results need to be saved or searched. For example, a small office audit may find 40 USB entries on a laptop, but only 6 are currently connected. That gap can reveal old flash drives, test devices, or hardware that was removed weeks ago. The cleanest workflow is: show hidden devices, review USBDeview, export results with PowerShell.

What “hidden USB devices” means

A hidden USB device is usually a non-present device. It was connected before, but it is not connected now. Windows may still keep its driver, device ID, serial number, and other details. These entries are not always bad. They can be normal leftovers from keyboards, webcams, docks, phones, and flash drives.

The catch is that Windows does not make this obvious. A device can be gone from File Explorer but still live in the system history. That drives some admins mad during cleanup, because a simple check can turn into a 20-minute hunt through grey icons and old driver names.

Method 1: Find hidden USB devices with Device Manager

Device Manager is the safest place to start. It is built into Windows and does not need extra software.

Open the Start menu.
Type Device Manager and open it.
Select View.
Click Show hidden devices.
Expand these sections:
- Universal Serial Bus controllers
- Disk drives
- Portable Devices
- Human Interface Devices
- Storage controllers

Greyed-out items usually mean the device is not connected. A grey USB storage device may be an old thumb drive. A grey phone entry may be a device used for file transfer. A grey printer or scanner may be harmless.

If Device Manager does not show enough, an administrator can open Command Prompt as admin and run:

set devmgr_show_nonpresent_devices=1
start devmgmt.msc

Then View > Show hidden devices should be checked again. This older trick still helps in some stubborn cases.

Method 2: Use USBDeview for USB history

USBDeview from NirSoft is a small utility that lists USB devices connected to the computer now and in the past [source: NirSoft]. It is useful because it shows details that Device Manager often hides.

USBDeview may show:

Device name
Device type
Serial number
Vendor ID and product ID
Connected status
Drive letter
First connected and last connected time

Honestly, it feels like Windows should show these fields by default. It does not. USBDeview fills that gap fast.

After opening USBDeview, the user can sort by Connected to separate current devices from old ones. Sorting by Device Type helps find mass storage devices faster. Sorting by Last Plug/Unplug Date can reveal recent activity.

Care is needed before removing entries. Deleting the wrong item can force Windows to reinstall a driver later. That is usually not a disaster, but it can waste time. For shared workstations, the safer move is to export the list first, then remove only known stale entries.

Method 3: Find USB devices with PowerShell

PowerShell is ideal when results need to be searched, copied, or saved. It also helps when many PCs must be checked.

To list USB Plug and Play devices, PowerShell can run:

Get-PnpDevice -Class USB | Select-Object Status, Class, FriendlyName, InstanceId

To show only currently present USB devices, this works:

Get-PnpDevice -PresentOnly -Class USB | Select-Object Status, FriendlyName, InstanceId

To check stored USB mass storage records in the registry, an administrator can use:

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR" -ErrorAction SilentlyContinue |
ForEach-Object { Get-ChildItem $_.PSPath } |
Select-Object PSChildName, PSParentPath

This often reveals old flash drives and external disks. Admin rights may be required. If access is denied, PowerShell should be opened with Run as administrator.

For a simple export, this command saves the USB list to a CSV file:

Get-PnpDevice -Class USB |
Select-Object Status, FriendlyName, InstanceId |
Export-Csv "$env:USERPROFILE\Desktop\usb-devices.csv" -NoTypeInformation

Best cleanup approach

The safest process is simple:

Check Device Manager for greyed-out entries.
Use USBDeview to confirm dates, serial numbers, and connection status.
Use PowerShell to export proof or scan many machines.
Remove only known stale devices.
Restart Windows after major driver cleanup.

Hidden USB entries are not proof of malware. They are clues. A strange USB storage device on a personal laptop may be nothing. The same device on a locked finance workstation may need review.