Eventlog when USB Device connected

Posted: 01-21-2009, 09:00 AM
Hello,

I've got a virus alert message from a client in our network.

The drive letter of the infected partition points me to an external usb
device.

To be sure I would like to know if it is possible to see in the eventlog or
somewhere else when an usb device was connected.

I couldn't find anything in system or application log yet.

I had switched on auditing for the security log. May be I can find
something there what could give me an idear when such an event was occuring,
but don't know for what I could search for.


Eventlog when USB Device connected


Responses to "Eventlog when USB Device connected"

Steffen Pelzetter
Guest
Posts: n/a
 
Eventlog when USB Device connected
Posted: 01-21-2009, 09:00 AM
Hello,

I've got a virus alert message from a client in our network.

The drive letter of the infected partition points me to an external usb
device.

To be sure I would like to know if it is possible to see in the eventlog or
somewhere else when an usb device was connected.

I couldn't find anything in system or application log yet.

I had switched on auditing for the security log. May be I can find
something there what could give me an idear when such an event was occuring,
but don't know for what I could search for.


donald huang
Guest
Posts: n/a
 
Re: Eventlog when USB Device connected
Posted: 01-23-2009, 04:13 AM
You can block USB flash drive or USB hard disk, CD ROM etc. by using GPO.

The following link is about how.

Disable USB disks with GPO
http://www.petri.co.il/disable_usb_disks_with_gpo.htm

For a bit more links about that, you can take a look at the following post.

http://social.technet.microsoft.com/...7c4d13/#page:1

Which version of Windows are you using? I can check the event id with the OS
version. You can then use SCCM2007 to monitor it or use SMS2003 to check
hardware inventory.



"Steffen Pelzetter" <SteffenPelzetter@discussions.microsoft.com> wrote in
message news:88A13A49-4DD0-48B8-AC22-AE0118410E64@microsoft.com...
> Hello,
>
> I've got a virus alert message from a client in our network.
>
> The drive letter of the infected partition points me to an external usb
> device.
>
> To be sure I would like to know if it is possible to see in the eventlog
> or
> somewhere else when an usb device was connected.
>
> I couldn't find anything in system or application log yet.
>
> I had switched on auditing for the security log. May be I can find
> something there what could give me an idear when such an event was
> occuring,
> but don't know for what I could search for.
>
>
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
my computer running XP won't see a device i connected with firewire 400, what do i do to fix this Guest Windows NT/2000/XP 0 04-09-2008 02:15 PM
Can I get a program to run when a particular USB device is connected? Mark F Windows XP Configuration & Management 0 03-04-2008 11:34 PM
in hibernation-- turning off usb device connected via USB hub-- Robert J. Lafayette Windows Vista Hardware & Devices 0 02-24-2008 11:30 PM
S-VHS-connected output device ce Windows XP Video 1 01-18-2005 10:18 PM
computer start up when usb device connected timashton Windows XP Hardware 1 01-01-2004 12:17 PM