Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

We would like to monitor the unauthorized file copy from our local server to USB storage devices. We are not sure where windows logs all the USB storage devices connections.

Please tell me, Is there any way to see the history/log of all USB devices connected to our server?

share|improve this question
1  
I think you want logging independent of windows logs/registry (tenable software), anyone with intent will erase/modify the registry entry for their device. When all else fails use video surveillance. – Moab Feb 23 '12 at 15:14

2 Answers

up vote 1 down vote accepted

Exact times, generally no.

USB dev view should give you an idea what devices were used, and when they were first seen by the system. This is based off a registry entry and other information.

If you're interested in doing this manually forensics wiki explains that this information is stored in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\ as well as setupapi.log. If you periodically clear those those places, it may give you an idea if the device was reattached or reinstalled

share|improve this answer
up vote 2 down vote

This may be done with an audit software like Nessus:

Track and monitor USB device usage (Video 3:16 min) http://www.tenable.com/expert-resources/videos/1078

Nessus 5 support Windows XP, Server 2003, Server 2008, Server 2008 R2, Vista, and 7 (i386 and x86-64)

Hope this help. Let us know.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.