Set a removal rule
- Open Triggers and choose USB device removed → Restart.
- Set USB device connected → Do nothing if reconnection should not request another response. Configure the remaining normal events deliberately.
- For the same behavior while locked, enable Windows locked → Monitor while Windows is locked and set USB device removed → Restart there too.
- Save, then start Test monitoring (no actions) from the tray.
For locked-only use, leave every normal event at Do nothing, configure just the locked profile, and save without enabling. Test that arrangement through a whole-app Test monitoring.cmd launch.
Use a safe removal test
Start with a spare non-storage peripheral. Avoid pulling a drive that contains open files or disconnecting equipment required to control the PC. After removing the test device, stop the dry run and inspect Event history. You should see the removal event, applicable profile and simulated restart.
Repeat with the dock or hub in its everyday configuration. One disconnection can report USB removal, display removal and layout changes together. Check all relevant rules rather than assuming a cable produces just one event.
What the rule does
Once an activated release is monitoring, the reported removal requests restart without a configured response delay. Windows may allow applications to object unless Force apps to close is enabled; forcing closure can lose unsaved work. Signing in cannot cancel a power request already sent to Windows.
Removal is not tied to a particular USB token or serial number. Driver resets and ordinary reconnections can also appear as device changes. DeskLatch does not turn a USB stick into an authentication key and cannot stop someone terminating an ordinary user process.
Pair this with monitor-disconnection rules for a docked workstation, or compare it with shutdown on USB arrival.