When I am making a review of session 0 and windows service, I would like to write a small example to detect the plug and unplug event of USB stick and attach it to windows service. I used ManangementEventWatcher class to subscribe to temporary event notifications based on a specified event query. This query is a type of WqlEventQuery class which represents a WMI event query in WQL format.