How Windows Identifies USB Devices - Understanding VID, PID, and Hardware IDs (Complete Guide for 2026)

This article breaks down VID, PID, serial numbers, and hardware IDs in a clean, operator‑friendly way — with examples, screenshots, and real‑world maritime implications.

Introduction: Why USB Identification Still Matters in 2026

Every USB device that touches a Windows system carries an identity — a set of hardware‑level identifiers that determine how the OS treats it, how security tools classify it, and whether it’s allowed or blocked. These identifiers are Vendor ID (VID), Product ID (PID), and Hardware IDs.

For most people, these values are invisible.
For security teams — especially in maritime environments — they’re everything.

If you’re trying to whitelist chart update USBs, block rogue devices, or enforce predictable removable media policies, you need to understand how Windows sees USB hardware.

This article breaks down VID, PID, serial numbers, and hardware IDs in a clean, operator‑friendly way — with examples, screenshots, and real‑world maritime implications.

1. What Is a USB VID (Vendor ID)?

VID = Vendor ID
A four‑digit hexadecimal value assigned by the USB Implementers Forum (USB‑IF).
It identifies the manufacturer of the device.

Common examples

Manufacturer	VID
Kingston	`0951`
SanDisk	`0781`
Samsung	`04E8`
Transcend	`8564`
Generic / No‑name	Often reused or spoofed

Why VID matters

Security tools use it to identify the manufacturer.
It’s stable across product lines.
It’s the first filter in USB whitelisting.

But VID alone is not enough — because many vendors reuse the same VID across dozens of product families.

2. What Is a USB PID (Product ID)?

PID = Product ID
A four‑digit hexadecimal value assigned by the manufacturer.
It identifies the specific product model or variant.

Examples

A Kingston DataTraveler might appear as:

VID_0951&PID_1666

A SanDisk Ultra Flair might appear as:

VID_0781&PID_5591

Why PID matters

It distinguishes one USB model from another.
Security tools rely on it for precise whitelisting.
It’s the most commonly used identifier in SentinelOne/ESET rules.

The problem

Manufacturers change PIDs frequently — even within the same product line.

This is where maritime workflows break down:

Chart providers ship USBs monthly.
Each batch has different PIDs.
Security tools treat each PID as a new device.
Crew cannot whitelist them.

We’ll cover this pain in Article 3.

3. What Is a USB Hardware ID?

A Hardware ID is the full identity string Windows uses to classify a USB device.

It looks like this:

USB\VID_0781&PID_5591\1234567890ABCDEF

This includes:

Vendor ID
Product ID
Serial number (if present)

Breakdown

USB\ → Device class
VID_0781 → Vendor (SanDisk)
PID_5591 → Product (Ultra Flair)
1234567890ABCDEF → Serial number

Why Hardware IDs matter

Security tools can match:

VID only
VID + PID
VID + PID + serial
Device class (mass storage, HID, network adapter, etc.)

Serial numbers are the most precise — but many USBs don’t have them, or they’re unstable.

4. How to Find VID/PID in Windows

4.1 Using Device Manager

Open Device Manager
Expand Universal Serial Bus controllers
Right‑click the USB device → Properties
Go to Details
Select Hardware IDs

You’ll see something like:

USB\VID_0951&PID_1666\001A4B3C5D6E7F90

4.2 Using PowerShell

This is the cleanest method for operators:

Get-PnpDevice -Class USB | Select-Object Name, InstanceId

Or to extract only VID/PID:

Get-PnpDevice -Class USB |
    Select-String -Pattern "VID|PID"

4.3 Using WMIC (Legacy but still works)

wmic path Win32_USBControllerDevice get Dependent

5. Why VID/PID Are Critical for Security Tools

Security platforms like:

SentinelOne
ESET
CrowdStrike
Microsoft Defender for Endpoint

…use VID/PID to:

Allow specific USB models
Block unknown devices
Enforce removable media policies
Detect BadUSB impersonation
Log device usage

VID/PID is the foundation of USB control.

But it’s also the Achilles heel — because it assumes predictable hardware.

6. Why VID/PID Break Down in Maritime Environments

Vessels receive USBs from:

Chart providers
OEMs
Service engineers
Third‑party vendors
Port authorities

These USBs:

Are not standardized
Come from different manufacturers
Change PIDs every batch
Often lack serial numbers
Are handled by non‑technical crew
Must work offline

This creates a nightmare for VID/PID‑based whitelisting:

Every new USB = new PID
Every new PID = new rule
Crew cannot add rules
Vessels may be offline
Updates get blocked
Operations get delayed

This is exactly why SentinelOne/ESET policies collapse in maritime — and why our next article focuses entirely on this pain.

7. Summary: VID/PID Are Essential — But Not Enough

VID and PID are the identity card of every USB device.
They are essential for:

Whitelisting
Auditing
Security enforcement
Device classification

But they are not reliable in environments where:

USBs are unpredictable
Vendors ship new devices monthly
Serial numbers are missing
Crew cannot manage policies
Vessels operate offline

This is why maritime needs workflow‑based USB control, with simple, managed and automated VID/PID‑based control.