Monitor USB usage on an employees PC

John L. Vaughan 46 Reputation points
2021-04-28T16:01:04.063+00:00

Hey All, IT noob here. So fairly simple question with what I'm sure is a fairly not simple answer...

Pretty much, I would like to be able to monitor when a USB storage device is plugged in to this employees PC and what data is transferred to it. We are going to be letting them go but don't necessarily "trust" them. I don't know if MS has a built in feature for something like this or if I have to enable it manually on the PC itself. Thanks for any guidance

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,762 questions
Accepted answer
  1. Jenny Feng 14,081 Reputation points
    2021-04-29T02:17:19.9+00:00

    @John L. Vaughan
    Hi,
    You mean you would like to track data transfer to USB device, right?
    The MS built-in program cannot fully achieve your purpose, Event Viewer can provide some information.
    For example when a USB flash drive was connected to a system, when it was disconnected, and ultimately how long the USB flash drive was connected to a system.
    https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/

    See also:
    Monitor the use of removable storage devices
    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices

    According to your requirements, you'd better take a look the third-party software suggestions:
    https://community.spiceworks.com/topic/937845-tracking-data-transfer-to-usb-device
    Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

    Hope above information can help you.

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Reza-Ameri 16,836 Reputation points
    2021-04-28T19:50:45.323+00:00

    You may try Audit Removable Storage, take a look at:
    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-removable-storage
    You may also use WMI too.
    However, in case you concern about the data transfer , it would be better to enforce Data Leak Prevention (DLP) where even if they transfer data using USB or other means, they won't be able to access it in untrusted device.

    0 comments