We have been working hard on the next version of Network Administrator.
As we build out our new libraries for it, we are releasing free tools based on our internal framework.
It allows us to field test aspects of the execution engine, and at the same time you get a freebie.
Right now, the plugin system allows us to disable usb flash drives, or change power settings, etc… but it is limited in the fact it can’t report back detailed information.
The latest tool that we are releasing, allows you to get a history of all USB flash drives that have ever been mounted on a computer.
You just pick a computer (Use localhost for the current computer), hit start, and it shows you a complete report:
It includes the device ID, a date and time stamp of the last time it was used, and it will even let you know if it is currently mounted.
You can download it from our downloads page:
http://www.intelliadmin.com/index.php/downloads/
Oh, and by the way. This type of functionality will be included in the next version of Network Administrator. If you purchase today, it will be a free upgrade.
One more thing…Subscribe to my newsletter and get 11 free network administrator tools, plus a 30 page user guide so you can get the most out of them. Click Here to get your free tools
{ 10 comments… read them below or add one }
Timely post as usual steve. Just last week we had a need to see if, and when a flash drive was used on one of our servers. There are a few free command line tools out there that I found, but I like your easy to use GUI interface. Plus the fact that none of the ones I found can do it remotely.
BTW, Just purchased a copy of Network Administrator. Great tool
Thanks for the kind words, and the order 🙂
Will this show me a drives that are not plugged in, but were plugged in at one time before?
Hello Jen,
Yes. It will show you a list of all the USB drives that were connected to the machine….unless of course someone went into the registry and deleted the history.
Unfortunately it doesn’t show you a history of their plugging and unplugging, which can be Very Useful Info when tracking down which of your many USB devices is infected.
USBlogger will do that, but it’s abandonware from Uwe Sieber, with whom I have exchanged emails. He says it’s free to use even in commercial environments. It has to be installed as a Windows Service, and it’s hard-coded to use certain file paths unfortunately.
It would be a Good Thing if Network Administrator were to add this capability.
Grab a copy here:
http://www.uwe-sieber.de/files/usblogger.zip
Similar tool, freeware, is available from NirSoft.net:
View any installed/connected USB device on your system
http://nirsoft.net/utils/usb_devices_view.html
Yea Angus, have used that one before too. I like this intelliadmin one since every option is on the main screen. I am looking for quick and intelli has got it nailed.
Thanks for the links Angus…I will have to check them out. The trouble with logging like that with Network Administrator is that it would have to run as a service on the machine….just like his…this is because you need to sit there and watch for USB device changes. This is somewhat similar to what we do with USB Disabler Pro:
http://www.intelliadmin.com/index.php/usb-disabler-pro/
We are working on a new version of that too…so these are all good ideas 🙂
Too bad Event Viewer doesn’t log USB insertions and removals in an EVT file.
I personally would like to see a tool which can:
1. log Date and Time| UID | Hostname| Data Usage in MBs| Where was data copied from?
2. Should have capability to run against multiple machines.
3. HTML, CSV friendly reporting.
My use case is to keep tabs on how USB devices are used in the firm and find out whether there is a data leak or virus, malware, grayware being introduced to our environment.
Hopefully these reqs are useful in your future update/design of the tool.
Best,
DK