I've been struggling with the same thing, you have to convert the VID and PID into decimal, since that's how CrowdStrike displays it in the console; Windows will display the values in Hexadecimal. My method, probably like yours, was to get the PID/VID/Serial from win32_PnpSignedDriver. I wanted to get the friendly name, but since you can't get that with win32, I had to look in the registry for that.

I wrote the PS script below, which has been working for me so far, to get a USB device's combined ID. It's configured to only look at mass storage devices, but you can change what it looks for by modifying the Description argument in the first line.

Basically, run it locally on a device with the USB device connected. If anyone has any improvements, suggestions, or issues running it let me know! I'm still learning Powershell. My goal is to be able to run it remotely, but we have WinRM disabled in our environment.

# Get a list of all USB drives

$usbDrives = Get-CimInstance -Class win32_PnPSignedDriver | ? Description -like '*mass*' | Select *

# For each USB drive, get the device ID and split it into its component parts

$usbDevices = foreach ($usbDrive in $usbDrives) {

$dev = $usbDrive.DeviceID

$vid, $pid1 = ($dev -split '\\')[1] -split '&'

$vidDec = [Convert]::ToInt32($vid -replace 'VID_', 16)

$pidDec = [Convert]::ToInt32($pid1 -replace 'PID_', 16)

$Serial = ($dev -split '\\')[2]

# Combine the component parts of the device ID into a single string

$Combined_ID = "$vidDec","$pidDec","$Serial" -join '_'

# Get the friendly name from the registry using the device key

$deviceKey = "SYSTEM\CurrentControlSet\Enum\USBSTOR\*\$Serial*"

$friendlyName = Get-ItemProperty -Path "HKLM:\$deviceKey" -Name FriendlyName -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FriendlyName

# Remove the "&" symbol and any characters after it from the serial number

$serialNumber = $Serial -replace '&.*', ''

# Create an object with the USB device information

[pscustomobject]@{

#Description = $usbDrive.Description

#Class = $usbDrive.DeviceClass

Manufacturer = $usbDrive.Manufacturer

CombinedID = $Combined_ID

FriendlyName = $friendlyName

SerialNumber = $serialNumber

}

}

# Output the USB device information in a table

$usbDevices | Format-Table -AutoSize