What is the Removable Media Auditor?
A.
It allows you to see what information has been copied to CD/DVD
B.
It creates a complete audit history of all activity which occurs on removable media
C.
It allows you to see what processes have opened which files
D.
All of the above
Explanation:
Removable Media Audit rules
Removable Media Manager is a very powerful component for controlling the
use of removable media storage devices. The Removable Media Audit tab
provides the ability to audit all file operations performed on removable media
devices and CD/DVD drives. From the RMM Audit tab it is possible to
configure a profile to either audit every file operation performed or to build a
complex set of rules based on certain defined criteria. Removable Media
Audit can record the following information:
ID: The log ID number is an incremental number and is used to make
searching events easier
Date & Time: Records information about the time and date at which the
audit event occurred.
Host Name: The machine name on which the event occurred.
Operation Type: The type of operation that was performed on the
removable media device:
Create: Audits the creation of new files
Open for Write: Audits any files that are opened for write access.
Move/Rename: Audits file moves and renames
Delete: Audits file deletions
Filename1: Records the file name & extension
Filename2: Records the new filename if a file rename is performed
Process: Records the process name that performed the file operation (e.g
Winword.exe, Explorer.exe etc)
User Name: Records the Domain and User Name of the current user
Alert: Details whether there is an alert configured for the selected event
(Yes/No)
Reset
Disables all removable media auditing from the current profile.
Log all
By selecting this option all removable media file operations will be audited
within the current profile.
IMPORTANT NOTE: This option can generate large amounts of audit
information and should be used with caution.
Add
It is possible to build a set of defined rules to control which removable media
events are audited. To build a removable media audit rule select Add