USB Audit Trail Who Plugged What and Copied Which Files
Blocking stops the copy. The audit trail explains the office - device, computer, user, time and file names, in one report. Read it weekly, act on patterns, treat single rows as questions.
Technical AnshuManageEngine Device Control PlusFor IT admins
Watch the full video - Device Control Plus setup shown step by step on screen
Blocking answers the question "can this device work here?" The audit trail answers the harder ones: who plugged what into which computer, when - and which files went with it? When a client list leaks or a pen drive of drawings appears at a competitor, those answers are the difference between an investigation and an argument. ManageEngine Device Control Plus records device actions and file activity centrally, and the video shows where those reports live. This page is about reading them like an admin, not collecting them like a hoarder.
11:07 - PC-ACCOUNTS-02ClientList.xlsx copied to driveTRACED
18:40 - PC-RECEPTIONPhone storage blockedDENY
21:15 - PC-DESIGN-01Trusted drive used after hoursCHECK
Example rows with invented file names and times. Read real reports for patterns, not single lines.
Illustration of an audit report. One odd row is a question to ask, never proof by itself.
1
What the Trail Actually Records
Device Control Plus keeps records of the devices, users and computers it manages, and reports device actions and data usage activity. In practice that means each event can tell you:
Device - what was plugged in, and whether it was trusted or unknown.
Computer and user - which PC, and who was logged in at the time.
Action - allowed, blocked, read, or written.
Files - with file tracing, the names and locations of files moved to removable media; with file shadowing, mirror copies of transferred files are kept in a protected share for review.
Turn these reports on before enforcement day, so the record starts with the policy - not halfway through the first incident.
2
Read for Patterns, Not Single Lines
A weekly ten-minute read beats a yearly panic. Look for:
Repeated blocked attempts on one PC - someone has a real need, or a real habit. Either way, talk to them.
After-hours trusted device use - sometimes overtime, sometimes not. The time column is what makes the question askable.
Large or unusual files in the trace - a database or archive in the file list matters more than fifty documents.
A device appearing on many PCs - one drive touring the office spreads both data and malware risk.
Set instant alerts for blocked attempts on your most sensitive machines so the important events reach you instead of waiting for the weekly read.
3
Handle What You Find Like a Professional
An audit row is a lead, not a verdict. Files are copied for innocent reasons every day - confirm the story before you accuse anyone.
Preserve the report and any shadow copies untouched if an incident looks real; evidence you edited is evidence you destroyed.
Restrict who can open the reports and the shadowing share. The audit trail itself contains sensitive information about staff behaviour - it deserves the same protection as the data it guards.
Decide a retention period and keep to it. Keeping years of staff activity "just in case" is a liability, not an asset.
Honest limit: the trail only covers managed PCs and removable media. It will not show what left by email or cloud upload, and it starts from the day you enabled it. Present it to management as exactly that - strong evidence for the USB door, silence about the others.
Watch the Complete Video Guide
The full Device Control Plus walkthrough - policy creation, trusted devices and reports, shown live step by step.
Can the audit report show which files were copied to a pen drive?
Yes, with file tracing enabled, Device Control Plus records file names and locations for transfers to removable media, along with the computer, device and user involved. File shadowing can additionally keep mirror copies of transferred files in a protected share for forensic review.
A blocked attempt shows in the report. Does that mean the staff member did something wrong?
Not by itself. People plug in the wrong drive, charge a phone, or simply forget the rule. A blocked attempt is a reminder conversation; a pattern of attempts, or copies at odd hours, is what deserves a closer look.
How long should we keep USB audit reports?
Long enough to investigate incidents and satisfy any compliance need - many offices keep a few months of detail. Decide the period in advance, write it in the policy, and delete on schedule instead of accumulating staff activity forever.
This guide is based on the Technical Anshu video on controlling USB devices in the office - stuck on any step, ask in the video comments.