The advanced security audit policy setting, Audit PNP Activity, determines when plug and play detects an external device.