Options

Event Viewer

Michael2Michael2 Member Posts: 305 ■■■□□□□□□□
in Off-Topic
Can Event Viewer tell you if a portable device was plugged in to your PC and used to copy a file?
· Share on FacebookShare on Twitter

Comments

  • Options
    buzzkillbuzzkill Member Posts: 95 ■■□□□□□□□□
    You will have needed to enable the audit object access group policy for it to show activities performed on files and folders, as well as enabled auditing on the folders/files in question. So no is probably the answer to that!

    However there will be something in the system log that showed the portable device service start running. This will likely only show once per session so if you already had one plugged in you may not see this at the time you suspect, worth a look anyway.
    · Share on FacebookShare on Twitter
Sign In or Register to comment.