question

JohnLVaughan-4034 avatar image
0 Votes"
JohnLVaughan-4034 asked JennyFeng-MSFT commented

Monitor USB usage on an employees PC

Hey All, IT noob here. So fairly simple question with what I'm sure is a fairly not simple answer...

Pretty much, I would like to be able to monitor when a USB storage device is plugged in to this employees PC and what data is transferred to it. We are going to be letting them go but don't necessarily "trust" them. I don't know if MS has a built in feature for something like this or if I have to enable it manually on the PC itself. Thanks for any guidance

windows-10-security
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@JohnLVaughan-4034
Hi,

Just checking in to see if the information provided was helpful.

If the reply helped you, please remember to accept as answer.
If no, please reply and tell us the current situation in order to provide further help.

0 Votes 0 ·
JennyFeng-MSFT avatar image
0 Votes"
JennyFeng-MSFT answered

@JohnLVaughan-4034
Hi,
You mean you would like to track data transfer to USB device, right?
The MS built-in program cannot fully achieve your purpose, Event Viewer can provide some information.
For example when a USB flash drive was connected to a system, when it was disconnected, and ultimately how long the USB flash drive was connected to a system.
https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/

See also:
Monitor the use of removable storage devices
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices

According to your requirements, you'd better take a look the third-party software suggestions:
https://community.spiceworks.com/topic/937845-tracking-data-transfer-to-usb-device
Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Hope above information can help you.

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Reza-Ameri avatar image
0 Votes"
Reza-Ameri answered Reza-Ameri rolled back

You may try Audit Removable Storage, take a look at:
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-removable-storage
You may also use WMI too.
However, in case you concern about the data transfer , it would be better to enforce Data Leak Prevention (DLP) where even if they transfer data using USB or other means, they won't be able to access it in untrusted device.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.