Monitoring usage of removable drives

To enable monitoring of removable drive usage:

1. In the lower part of the main application window, click the button.
2. In the application settings window, select Protection → Security Controls → Device Control.
3. In the Settings block, click the Access rules for devices and Wi-Fi networks button.

   The opened window shows access rules for all devices that are included in the Device Control component classification.

4. In the Access to storage devices block, select Removable drives.
5. Click the Logging link.
6. In the opened window, select the Logging tab.
7. Turn on the Logging toggle.
8. In the File operations block, select the operations that you want to monitor: Write, Delete.
9. In the Filter by file formats block, select the formats of files whose associated operations should be logged by Device Control.
10. Select the users or group of users whose use of removable drives you want to monitor.
11. Save your changes.

As a result, when users write to files located on removable drives or delete files from removable drives, Kaspersky Endpoint Security will save information about such operations to the event log and send events to Kaspersky Security Center. You can view events associated with files on removable drives in the Kaspersky Security Center Administration Console in the workspace of the Administration Server node on the Events tab. For events to be displayed in the local Kaspersky Endpoint Security event log, you must select the File operation performed check box in the notification settings for the Device Control component.