Re: Logging of USB devices?

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 09/19/04


Date: Sun, 19 Sep 2004 20:46:46 GMT

The actual connection to the computer may be recorded in Event Viewer. You might have
to enable auditing of system events first. W2K allows enabling auditing of object
access that then allows you to audit folders. A copy is a read on source and write on
destination. You would have no way of knowing if a file was copied or not to an
external device. You could only tell if a user had accessed a file on the hard drive
and only if that folder had auditing enabled which they do not by default. --- Steve

"T-Bar" <tbar@replytonewsgroup.com> wrote in message
news:%23dl7ZpknEHA.2680@TK2MSFTNGP15.phx.gbl...
> Follow-up to microsoft.public.win2000.security
>
> Hello,
>
> Is there a way to find out if a USB device has been attached to a computer
> in the past and if data has been copied from this computer onto the device?
> If yes, is there a way to find out if certain files or folders were copied
> from the local harddrive (or network drive) to the device?
>
> Cheers, T-Bar
>
>



Relevant Pages

  • Re: auditing help needed
    ... Auditing of files and folders certainly has its ... controllers at the domain controller policy level. ... > want to enable auditing on every file/folder for failure so I can see ...
    (microsoft.public.win2000.security)
  • Re: Logging of USB devices?
    ... to enable auditing of system events first. ... access that then allows you to audit folders. ...
    (microsoft.public.win2000.security)
  • Re: Permissions for shared folders
    ... bottom folders, since the propagation occurrs. ... Be aware of such of tricky securty settings.. ... >You would enable Auditing to track file access. ... >must both enable logging in the overall computer policy ...
    (microsoft.public.win2000.security)
  • RE: Sharing Folder and Files
    ... you need to enable Local Security Auditing and then auditing on your ... The audited entries can be viewed under Event Viewer --> Security. ... --> Enable auditing on your folders. ...
    (microsoft.public.win2000.file_system)
  • RE: Sharing Folder and Files
    ... I have enabled the local security auditing and auditing on ... my folders. ... double-click Audit ...
    (microsoft.public.win2000.file_system)