Hello everyone, there is a table usb_devices, unfortunately not for windows. So I was wondering how I could achieve the same for windows clients. Any ideas?

There is likely a native Windows Event that gets created when a USB is plugged in/unplugged, maybe you could query the

windows_events

or

windows_eventslog

table using the event id?