Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We would like to monitor the unauthorized file copy from our local server to USB storage devices. We are not sure where windows logs all the USB storage devices connections.

Please tell me, Is there any way to see the history/log of all USB devices connected to our server?

share|improve this question
I think you want logging independent of windows logs/registry (tenable software), anyone with intent will erase/modify the registry entry for their device. When all else fails use video surveillance. – Moab Feb 23 '12 at 15:14
up vote 1 down vote accepted

Exact times, generally no.

USB dev view should give you an idea what devices were used, and when they were first seen by the system. This is based off a registry entry and other information.

If you're interested in doing this manually forensics wiki explains that this information is stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\ as well as setupapi.log. If you periodically clear those those places, it may give you an idea if the device was reattached or reinstalled

share|improve this answer

This may be done with an audit software like Nessus:

Track and monitor USB device usage (Video 3:16 min)

Nessus 5 support Windows XP, Server 2003, Server 2008, Server 2008 R2, Vista, and 7 (i386 and x86-64)

Hope this help. Let us know.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .