Answered by:
monitor USB insertion in SCOM 2007 R2

Question
-
Hi,
I tried to monitor USB by enabling teh object Discovery of Physical Disk and the view was showing the data ,is there a way to use the attributes to make a monitor or rule to Monitor USB insertion?
Second option could be using the WMI query but i dont know how to make proper notification query format supported in SCOM 2007 .Can any one help me in this
Regards,
SA
Thursday, October 6, 2011 10:55 AM
Answers
-
Hi,
You may get some idea from the following thread:
Regarding using WMI in SCOM, please refer to the following article:
http://blogs.technet.com/b/kevinholman/archive/2008/07/01/using-wmi-event-rules.aspx
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 8:34 AM -
Not really going to be practical via disk discovery. You will need to look for the security events. If you want to prevent this, you should use POLICY to manage USB devices.
In OM, if you can identify an EVENT that represents the insertion you are interested in, you can collect them for tracking purposes. But ACS is much better for this kind of security reporting scenario.
Microsoft Corporation- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 4:04 PM
All replies
-
Hi,
You may get some idea from the following thread:
Regarding using WMI in SCOM, please refer to the following article:
http://blogs.technet.com/b/kevinholman/archive/2008/07/01/using-wmi-event-rules.aspx
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 8:34 AM -
Not really going to be practical via disk discovery. You will need to look for the security events. If you want to prevent this, you should use POLICY to manage USB devices.
In OM, if you can identify an EVENT that represents the insertion you are interested in, you can collect them for tracking purposes. But ACS is much better for this kind of security reporting scenario.
Microsoft Corporation- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 4:04 PM