Find Resources and Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

Subscribe to this discussion

How to Audit USB activities of users in windows?

Is there a way to audit USB activities of users in windows?
You must sign in to rate content.
(1 ratings)

Comments

RE: How to Audit USB activities of users in windows?

Did you look into the product "IEF" by Magnetic Forensics? See the URL "http://www.magnetforensics.com/investigating-user-activity-with-windows-artifacts-in-ief/"
Howard. GlassmanLively at 2/21/2015 8:03:56 PM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

I think some clarification on what exactly you are defining as "activities" would be helpful. Inserting a USB drive, transferring data, and so on...
DanP51Social at 7/7/2016 9:10:05 AM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

I know its an old thread, but maybe want to have a look at Lumension Device Control. https://www.lumension.com/device-control-software/usb-security-protection/features-and-benefits.aspx

It should cover your needs. It's a great product to block port access (USB and others). You will also be able to see which devices have been plugged in by the user. (Model, etc.)

Otherwise, as @DanP51 pointed out, you have to provide more details on what the requirement is exactly.

Peter HuerlimannSocial at 8/8/2017 4:57:45 PM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

HI,
If i have understood your concern in correct manner, you mean to say you would like to monitor the USER's USB activities like, what they have pluged? when ? and what they have copied? and if possible you would like to restrict them. 

Restriction to the USB stick, is possible through the Group Policy and this you can have with respect to device/system and not on user basis. You can achieve this by putting all expected systems in respective OU and configure Group Policy to that OU.

But you would like to monitor, what they have copied and would like to collect evidences and restrict to confidential data that to on user basis then i would suggest. You should go with DLP (Data Loss Prevention) applications. I shall not be able to suggest a specific one, on this forum but you can evaluate from Mcafee, Symatec, etc. This will cover not only USB concerns but also all other end point concerns.
Anand292Energizer at 1/2/2018 12:49:06 AM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

I may be a day late to this thread.  Take a look at this link (https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/).  It explains USB logging within Windows 7 - with minimal effort, you can probably find its relevance to Win10.
Michael057Observer at 3/21/2018 2:07:29 PM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

I may be a day late to this thread.  Take a look at this link (https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/).  It explains USB logging within Windows 7 - with minimal effort, you can probably find its relevance to Win10.
Michael057Observer at 3/21/2018 2:07:29 PM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

HI,
If i have understood your concern in correct manner, you mean to say you would like to monitor the USER's USB activities like, what they have pluged? when ? and what they have copied? and if possible you would like to restrict them. 

Restriction to the USB stick, is possible through the Group Policy and this you can have with respect to device/system and not on user basis. You can achieve this by putting all expected systems in respective OU and configure Group Policy to that OU.

But you would like to monitor, what they have copied and would like to collect evidences and restrict to confidential data that to on user basis then i would suggest. You should go with DLP (Data Loss Prevention) applications. I shall not be able to suggest a specific one, on this forum but you can evaluate from Mcafee, Symatec, etc. This will cover not only USB concerns but also all other end point concerns.
Anand292Energizer at 1/2/2018 12:49:06 AM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

I know its an old thread, but maybe want to have a look at Lumension Device Control. https://www.lumension.com/device-control-software/usb-security-protection/features-and-benefits.aspx

It should cover your needs. It's a great product to block port access (USB and others). You will also be able to see which devices have been plugged in by the user. (Model, etc.)

Otherwise, as @DanP51 pointed out, you have to provide more details on what the requirement is exactly.

Peter HuerlimannSocial at 8/8/2017 4:57:45 PM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

I think some clarification on what exactly you are defining as "activities" would be helpful. Inserting a USB drive, transferring data, and so on...
DanP51Social at 7/7/2016 9:10:05 AM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

Did you look into the product "IEF" by Magnetic Forensics? See the URL "http://www.magnetforensics.com/investigating-user-activity-with-windows-artifacts-in-ief/"
Howard. GlassmanLively at 2/21/2015 8:03:56 PM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

Did you look into the product "IEF" by Magnetic Forensics? See the URL "http://www.magnetforensics.com/investigating-user-activity-with-windows-artifacts-in-ief/"
Howard. GlassmanLively at 2/21/2015 8:03:56 PM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

I think some clarification on what exactly you are defining as "activities" would be helpful. Inserting a USB drive, transferring data, and so on...
DanP51Social at 7/7/2016 9:10:05 AM Quote
You must sign in to rate content.
(1 ratings)

RE: How to Audit USB activities of users in windows?

I know its an old thread, but maybe want to have a look at Lumension Device Control. https://www.lumension.com/device-control-software/usb-security-protection/features-and-benefits.aspx

It should cover your needs. It's a great product to block port access (USB and others). You will also be able to see which devices have been plugged in by the user. (Model, etc.)

Otherwise, as @DanP51 pointed out, you have to provide more details on what the requirement is exactly.

Peter HuerlimannSocial at 8/8/2017 4:57:45 PM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

HI,
If i have understood your concern in correct manner, you mean to say you would like to monitor the USER's USB activities like, what they have pluged? when ? and what they have copied? and if possible you would like to restrict them. 

Restriction to the USB stick, is possible through the Group Policy and this you can have with respect to device/system and not on user basis. You can achieve this by putting all expected systems in respective OU and configure Group Policy to that OU.

But you would like to monitor, what they have copied and would like to collect evidences and restrict to confidential data that to on user basis then i would suggest. You should go with DLP (Data Loss Prevention) applications. I shall not be able to suggest a specific one, on this forum but you can evaluate from Mcafee, Symatec, etc. This will cover not only USB concerns but also all other end point concerns.
Anand292Energizer at 1/2/2018 12:49:06 AM Quote
You must sign in to rate content.
(Unrated)

RE: How to Audit USB activities of users in windows?

I may be a day late to this thread.  Take a look at this link (https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/).  It explains USB logging within Windows 7 - with minimal effort, you can probably find its relevance to Win10.
Michael057Observer at 3/21/2018 2:07:29 PM Quote
You must sign in to rate content.
(Unrated)

Leave a Comment

* required

You must login to leave a comment.