Removable Storage Audit

This reporting module provides audit information on files transferred via the USB. These reports can also be scheduled to run at user defined times and also be emailed to user mailboxes on a hourly, daily, weekly or monthly intervals.

Note: Works only on Windows 8/Windows Server 2012 and above

Pre-Configured Removable Storage Audit Reports

Click on the Reports tab and select the Removable Storage Audit tab on the left, to view the reports listing.

All File/Folder Changes

File Read

File Modified

File Copy and Paste

Audit every USB file changes across the Windows server environment. A Pie / bar chart summarizes the actions in the selected domain.

To view an Audit Report

1. Click on Reports Tab > Removable Storage Audit > Choose Report.
2. Select the Domain.
3. Select the Period (Today,Yesterday, This Week, This Month), a custom period can also be defined & saved for easy reference.
4. A graphical display with detailed events summary lists the audit information for the selected period.
5. Clicking on an event in the bar graph, filters the report view highlighting only the selected event.
6. Quick search option can be used for precise filtering.

Filter Attributes in the Removable Storage Audit Category

The below filter attributes can be added or removed to the reports under the Removable Storage Audit category using the Add / Remove Columns link.

{Absolute Name, Access Mask, Access Type, Accesses, Client Domain, Client Login ID, Client User Name, Domain, Event Number, Event Type, File Folder Name, Handle ID, Location, Login ID, Message, Modified by, Object Server, Object Type, Operation ID, Primary Domain, Primary Login ID, Primary User Name, Privileges, Privileges Used, Process ID, Process Name, Record Number, Remarks, Restricted SID Count, Server, Time Modified, Transaction ID, UNC Name, User SID}