locked
Registry Auditing for USB on Windows Vista RRS feed

  • General discussion

  • Hi,

    I would like to audit all USB connections made to a client machine. I have tried turning on registry auditing for the following key
    HKLM\System\ CurrentControlSet\Enum\ USBSTOR. I have followed the steps closely shown here - http://www.winxptutor.com/auditreg.htm to enable registry auditing.

    The auditing works fine and an entry was written into the seccurity log, but it is only for 1 instance. Subsequent USB connection with the same USB drive and on the same USB port does not have any more entries written into the security log.

    I would like to have to constant monitoring of all USB connections without using third party tools and only using Windows solution. Is this possible?
    Monday, March 30, 2009 12:57 PM

All replies

  • Hi Paul,

    I don't have an answer, but I would be very interested if someone could fix this.  We've been stuck in the dark ages for years on our secure networks because USB media connections cannot be properly tracked.  Now that Zip Disc has died, that leaves us with optical discs and the (dying) floppy.

    I would love for us to find a way to move into the 21st century, but the inability to have a full security log for all USB devices is a killer.

    If you get this question answered elsewhere, please post it here.
    Monday, May 4, 2009 4:32 PM