Hi everyone,
I wanted to know if events are generated when file copy are started between windows workstations, server and to USB key when the remote agent is installed.
Thank you.
-
-
Logs are generated. On the workstation/server side, you need to enable FIM and monitor the specific directories.
For the USB, the USB defender needs to be installed as an option to the agent installer.
Once these two things are done, you should be able to detect copy from server to usb.
Of course, I'm assuming you have the correct audit policies in place,as recommended by SolarWinds.
