asked on

Tracking removable storage with the Windows Security Log

We want to implement this across all computers in our domain. However our PDC is still running SBS 2008 and the Advanced Audit Policies are not available to do so. So before we go and touch 50 or so workstations, we're wondering if there is a simple way to do this, maybe through a script?

Ilídio Amaral

Check this.
If you have Powershell Remote enabled you can create a job for all machines.

Steve Marin

ASKER

Thanks for that. It does show USB devices that have been inserted to the machine, however not much else. We're looking to get maybe files transferred to and time stamps. Exactly what this gives.

https://www.eventtracker.com/newsletters/tracking-removable-storage-windows-security-log/

Ilídio Amaral

You can use powershell cmdlet get-winevent to get the events you want. Check this link to see soma examples.

Now for the hard part: getting the audit option enabled on your endpoints. Due to the SBS 2008 limitations GPO is not an option. The only workaround i can think of is to edit Windows Registry. Using a test endpoint,with procmon(sysinternals) and gpedit.msc its possible to track down which keys were changed. Using this information you can easilly create a powershell script to change this values on the other machines.

Having done this on a few ocasions where nothing else was possible I don't think this is the safest way of doing things, so think 10 times if this is an option for you.

ASKER CERTIFIED SOLUTION

McKnife

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Steve Marin

ASKER

I see now that is not going to be possible with Native auditing and Windows 7. All the current workstation are Windows 7.

Steve Marin

ASKER

This would have worked like a charm, but the endpoints are Windows 7 and that setting is not on them.