Eventlog when USB Device connected

[Steffen Pelzetter]

Hello,

I've got a virus alert message from a client in our network.

The drive letter of the infected partition points me to an external usb
device.

To be sure I would like to know if it is possible to see in the eventlog or
somewhere else when an usb device was connected.

I couldn't find anything in system or application log yet.

I had switched on auditing for the security log. May be I can find
something there what could give me an idear when such an event was occuring,
but don't know for what I could search for.

 

[donald huang]

You can block USB flash drive or USB hard disk, CD ROM etc. by using GPO.

The following link is about how.

Disable USB disks with GPO
http://www.petri.co.il/disable_usb_disks_with_gpo.htm

For a bit more links about that, you can take a look at the following post.

http://social.technet.microsoft.com.../3255d483-1be6-41a2-b6e3-33317e7c4d13/#page:1

Which version of Windows are you using? I can check the event id with the OS
version. You can then use SCCM2007 to monitor it or use SMS2003 to check
hardware inventory.