USB Drive Audit

[ljg]

I've been asked if we can determine the instances of USB removable drives being used in our domain. Is there a way to do this (i.e. a registry key to search for, etc) without purchasing 3rd party software?

Thanks in advance,
LJG

 

[ImpetusEra]

In event viewer it's listed under system log as removeable storage service events.

Received a device interface ARRIVAL notification for device:
\\?\USBSTOR#Disk&Ven_Memorex&Prod_TD_CLASSIC_003B&Rev_PMAP#07541C90CD1A&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Received a device interface REMOVAL notification for device:
\\?\USBSTOR#Disk&Ven_Memorex&Prod_TD_CLASSIC_003B&Rev_PMAP#07541C90CD1A&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}