Within LEM, is it possible to create a rule that will notify an email list when someone copies or modifies a PST or EXE file to or from a USB drive?
Within LEM, is it possible to create a rule that will notify an email list when someone copies or modifies a PST or EXE file to or from a USB drive?
Hey,
You will need to install the LEM Agent & USB Defender on each machine you want to monitor. When a user copies a file to a USB it generally appears as a FileCreate event like below. If they modify the file it will probably appear as a FileWrite event.
You could create a rule something like this:
I haven't tested that rule, but something along those lines should do the trick
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.