This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Remove From My Forums

monitor USB insertion in SCOM 2007 R2

Question
0

Sign in to vote

Hi,

I tried to monitor USB by enabling teh object Discovery of Physical Disk and the view was showing the data ,is there a way to use the attributes to make a monitor or rule to Monitor USB insertion?

Second option could be using the WMI query but i dont know how to make proper notification query format supported in SCOM 2007 .Can any one help me in this

Regards,

SA

Thursday, October 6, 2011 10:55 AM

Answers

0

Sign in to vote
Hi,

You may get some idea from the following thread:

http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/f3262c29-8be7-455e-970f-733fb7c88cd5/

Regarding using WMI in SCOM, please refer to the following article:

http://blogs.technet.com/b/kevinholman/archive/2008/07/01/using-wmi-event-rules.aspx
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 8:34 AM
0

Sign in to vote
Not really going to be practical via disk discovery. You will need to look for the security events. If you want to prevent this, you should use POLICY to manage USB devices.

In OM, if you can identify an EVENT that represents the insertion you are interested in, you can collect them for tracking purposes. But ACS is much better for this kind of security reporting scenario.
Microsoft Corporation
- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 4:04 PM

All replies

0

Sign in to vote
Hi,

You may get some idea from the following thread:

http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/f3262c29-8be7-455e-970f-733fb7c88cd5/

Regarding using WMI in SCOM, please refer to the following article:

http://blogs.technet.com/b/kevinholman/archive/2008/07/01/using-wmi-event-rules.aspx
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 8:34 AM
0

Sign in to vote
Not really going to be practical via disk discovery. You will need to look for the security events. If you want to prevent this, you should use POLICY to manage USB devices.

In OM, if you can identify an EVENT that represents the insertion you are interested in, you can collect them for tracking purposes. But ACS is much better for this kind of security reporting scenario.
Microsoft Corporation
- Marked as answer by Vivian Xing Tuesday, October 18, 2011 9:20 AM
Friday, October 7, 2011 4:04 PM