This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Audit removable device uses?

Is there a way to audit or list uses of a peripheral device (usb flash drive)? It seems someone had access that shouldn't have and we need to find out if they have done anything.

This thread was automatically locked due to age.

0 MEric over 4 years ago

Hi Joshua,

You can set your Device control policy to monitor but do not block to audit peripheral devices plugged in.

After some time monitoring, you can generate a report for device control under Tools > Manage reports.
Cancel
Vote Up 0 Vote Down

Cancel
0 Joshua Kucera over 4 years ago in reply to MEric

We are looking for historical data. We cannot time travel to turn on monitor but do not block in order to gain this data. We want to know IF a specific person HAS USED usb drives, and how many times, if so.
Cancel
Vote Up 0 Vote Down

Cancel
0 MEric over 4 years ago in reply to Joshua Kucera

If device control was not on previously there won't be any historical data on what peripheral devices a user has plugged in on the Sophos side.
Cancel
Vote Up 0 Vote Down

Cancel
0 Joshua Kucera over 4 years ago in reply to MEric

That answers that, thank you.
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 4 years ago

Anything in the Security Event log you could use? Event ID 6416 for example?
Cancel
Vote Up 0 Vote Down

Cancel