It occurs to me that I could monitor for an associated eventlog entry for usb device unplugged to catch a removed mouse or keyboard but wonder if there's a more elegant way. Thanks, Bill