This is the log when device configuration is changed (when a memory device is added along with the change of drive letter, and when device name and internal serial number change because the device in the same drive letter is changed) in the client (CT).
Set policy for collection
Set policy in the [Terminal Initial Settings] window, the [User Policy Settings] window or the window after the Management Console is started (CT policy settings window).
In the [Log Switches] tab, set [Device Configuration Change Log] to [Yes].
Collected information
The information displayed in [Notes] will be different due to the type of drive.
Drive Type | Volume | Device Name | Internal Serial Number | Server Name, Shared Name |
|---|---|---|---|---|
Fixed | ○ | ― | ― | ― |
Removable | ― | ○ (Note 1) | ○ (Note 1) | ― |
CD-ROM | ― | ○ (Note 1) | ○ (Note 1) | ― |
Remote (Note 2) | ― | ― | ― | ○ |
○: Collect information.
―: Do not collect information.
Note 1: The information is only recorded when a USB is connected.
Note 2: When sharing the floppy drive and USB memory device with another PC, the drive type will be recorded as “Remote”.
Displayed content
Logs that can be viewed are as follows:
[Name]: name of the client (CT)
[Occurrence Date and Time]: time for collecting logs at client (CT)
[User ID]: logon user name of the client (CT)
[Domain Name]: it is the domain name of the client (CT) when logging on to domain while it is the computer name of the client (CT) when logging on to local computer
[Type]: [Device Configuration Change] (fixed value)
[Classification]: [Normal] or [Violation] (Note 5)
[Attachment]: (not displayed)
[Content]: the following content is displayed.
[Add] or [Change] (Note 3)
Drive letter (Note 3)
Dirve Type (Note 3)
Note 3) When performing keyword search in Log Viewer, the value in [ ] can be specified as keyword.
Recorded as [Add] in the following cases:
When logging on, if there is drive added comparing the information at last logoff with the current drive information
When adding device in the logon status
When logging on after adding device in the status of not logon
When removing the connected device and connecting another device to the same drive in the logon status
Record as [Change] when any of the following operations is performed in the lgoon status.
When changing the drive type
When allocating the shared name of server to the existing network drive
[Note]: the following content is displayed:
Volumename (Note 4)
Device name (Note 4)
Internal serial number (Note 4)
Server name, shared name (Note 4)
USB device name (Note 6)
Manufacturer ID
Product ID
Note 4: When performing keyword search in Log Viewer, the value in the [] can be specified as a keyword.
Note 5: The situation of recording as a violation will be different due to the status of policy, whether to reflect policy, whether the Management Server can be communicated with and the status of the connected USB device. Logs that are recorded as violations will be output in the following cases.
Case 1
When the USB device whose [USB Identification Method] in the [USB Device Registration] window is [Unavailable] is connected
Case 2
When the period for use set in [Period for Using USB Device] in the [USB Device Registration] window is exceeded
Case 3
When [Allow to Use All USB Registered in Management Server] of the [File Export Prohibition - USB Device Individual Identification Function - Detailed Settings] window is set to [Yes], the Management Server cannot be connected to the client (CT)
Case 4
When [Export Prohibition] (specify drive or removable device) is selected in the [File Export Prohibition] tab.
Case 5
When [Read Prohibition] (specify removable device) is selected in the [File Export Prohibition] tab.
Note 6: When [USB Device Individual Identification Function] is set to [Available], the USB device name will be obtained.
Example of [Content] and [Notes]
When the information cannot be obtained, blank ([ ]) will be displayed.
When built-in hard disk is installed
Content | Notes |
[Added D: fixed] | Volume [Windows2003] |
When viewing the drive information in Explorer of OS, in case that “Local Disk (D:)” is displayed, the volume is displayed as blank ([ ]).
When USB memory device, hard disk and floppy drive, etc., connected via USB are connected
Content | Notes |
[Added G: Removable] | Device Name [BUFFALO USB Flash Disk USB Device], Internal Serial Number [B32986] |
When DVD/CD device connected via USB is connected
Content | Notes |
[Added E: CD-ROM] | Device Name [MATSHITA UJD330], Internal Serial Number [ ] |
For DVD/CD device not connected via USB (via IDE, IEEE, etc.), blank ([ ]) will be displayed in the notes column.
When network drive is added
Content | Notes |
[Added G: Remote] | Volume [SOUMUDISK], Server Name, Shared Name [\\ServerSOUMU\SOUMUDISK] |
“Server Name, Shared Name” may also be displayed as “\\IP Address of the Server\Shared Name”.
When individual identification of USB device is performed and the unauthorized USB device (identified as removable) is installed
Classification | Content | Notes |
Violation | [Added G: Removable] | Device Name [BUFFALO USB Flash Disk USB Device], Internal Serial Number [B32986] |
When the hard disk is physically damaged, and other applications exclusively access the file that records the previous device configuration, [Content] of device configuration change log may become “Unknown”.
Content | Notes |
[Changed A: Unknown→Removable] |
|
When violated
When the device configuration change log becomes violated, the following message will be displayed.
