This is the log when device configuration is changed (when a memory device is added along with the change of drive letter, and when device name and internal serial number change because the device in the same drive letter is changed or a USB device is connected) in the client (CT).
Set policy for collection
Set policy in the Terminal Initial Settings window, the User Policy Settings window or the window after the Management Console is started (CT policy settings window).
In Windows > Log collection operation, set Device Configuration Change Log to Yes.
Collected information
The information displayed in Notes will be different due to the type of drive.
Drive/device type | Volume | Device Name | Internal Serial Number, Manufacturer ID, Product ID | Server Name, Shared Name |
|---|---|---|---|---|
Fixed | Y | N | N | N |
Removable | N | Y (*1) | Y (*1) | N |
CD-ROM | N | Y (*1) | Y (*1) | N |
Remote (*2) | N | N | N | Y |
USB | N | Y (* 1) | Y (*1) | N |
USB (portable device) | N | Y (*1) | Y (*1) | N |
USB (imaging device) | N | Y (*1) | Y (*1) | N |
Y: Collect information.
N: Do not collect information.
*1: The information is only recorded when a USB is connected.
*2: When sharing the floppy drive and USB memory device with another PC, the drive type will be recorded as "Remote".
Displayed content
The following log content can be viewed:
Name: name of the client (CT)
Occurrence Date and Time: time for collecting logs at client (CT)
User ID: logon user name of the client (CT)
Domain Name: it is the domain name of the client (CT) when logging on to domain while it is the computer name of the client (CT) when logging on to local computer
Type: Device Configuration Change (fixed value)
Classification: Normal or Violation (Note 5)
Attachment: (not displayed)
Content: the following content is displayed.
Add or Change (Note 3)
Drive letter or USB (Note 3)
Drive type or portable device/imaging device type (Note 3)
Note 3: When performing keyword search in Log Viewer, the value in [ ] can be specified as keyword.
Recorded as Add in the following cases:
When registering a device configuration change log for the drive letter
When logging on, if there is drive added comparing the information at last logoff with the current drive information
When adding device in the logon status
When logging on after adding device in the status of not logon
When removing the connected device and connecting another device to the same drive in the logon status
When registering a USB device configuration change log
On startup of the PC, if there is a device added when comparing the information at last shutdown with the current USB device information
When a USB device is added after starting up the PC (obtained even when not logged in)
Record as Change when any of the following operations is performed in the logon status.
When registering a device configuration change log for the drive letter
When changing the drive type
When allocating the shared name of server to the existing network drive
When registering a USB device configuration change log
Not recorded as "Change".
Note: the following content is displayed:
Volume (Note 4)
Device name (Note 4)
Internal serial number (Note 4)
Server name, shared name (Note 4)
USB device name (Note 6)
Manufacturer ID
Product ID
Note 4: When performing keyword search in Log Viewer, the value in the [] can be specified as a keyword.
Note 5: The situation of recording as a violation will be different due to the status of policy, whether to reflect policy, whether the Management Server can be communicated with and the status of the connected USB device. Recording as a violation occurs when USB Device Individual Identification Function is set to Use, and the following pattern applies. Even when access is set as prohibited for non-USB connections (IDE connection, IEEE connection, PCMCIA connection, etc.) of removable devices or DVD/CD devices, such connections are recorded as normal.
Case 1
When the USB device whose USB Identification Method in the USB Device Registration window is Unavailable is connected
Case 2
When the USB device whose period for use set in Period for Using USB Device in the USB Device Registration window has expired is connected
Case 3
When Allow to Use All USB Registered in Management Server of the File Export Prohibition > USB Device Individual Identification Function > Detailed Settings window is set to Yes, the Management Server cannot be connected to the client (CT)
Case 4
When you select Export Prohibition (specify drive, removable, or DVD/CD) in File export/read and connect to a USB device that has not been permitted for use
Note that drive specification is recorded as normal in the USB device configuration change log.
Case 5
When you select Reading prohibition (specify removable or DVD/CD) in File export/read and connect to a USB device that has not been permitted for use
Pattern 6
When you select Portable device/imaging device connection prohibition in File export/read (specify portable device, or imaging device), and connect to a USB device that has not been permitted for use
Note 6: When USB Device Individual Identification Function is set to Available, the USB device name will be obtained.
Example of Content and Notes:
When the information cannot be obtained, blank ([ ]) will be displayed.
When built-in hard disk is installed
Content | Notes |
Add D: fixed | Volume Windows2003 |
When viewing the drive information in Explorer of OS, in case that "Local Disk (D:)" is displayed, the volume is displayed as blank ([ ]).
When USB memory device, hard disk and floppy drive, etc., connected via USB are connected
Content | Notes |
Add G: Removable | Device Name BUFFALO USB Flash Disk USB Device, Internal Serial Number B32986, Manufacturer ID: 1111, Product ID: 2222 |
When DVD/CD device connected via USB is connected
Content | Notes |
Add E: CD-ROM | Device Name MATSHITA UJD330, Internal Serial Number [ ], manufacturer ID: 3333, product ID: 4444 |
For DVD/CD device not connected via USB (via IDE, IEEE, etc.), blank will be displayed in the notes column.
When network drive is added
Content | Notes |
Add G: Remote | Volume SOUMUDISK, Server Name, Shared Name \\ServerSOUMU\SOUMUDISK |
"Server Name, Shared Name" may also be displayed as "\\IP Address of the Server\Shared Name".
When individual identification of USB device is performed and the unauthorized USB device (identified as removable) is installed
Classification | Content | Notes |
Violation | Added G: Removable | Device Name BUFFALO USB Flash Disk USB Device, Internal Serial Number B32986, Manufacturer ID: 1111, Product ID: 2222 |
When the hard disk is physically damaged, and other applications exclusively access the file that records the previous device configuration, Content of device configuration change log may become "Unknown".
Content | Notes |
Modify A:Unkown->Removable |
When a USB mouse is connected
Content | Notes |
Added USB | Device name: HID-compliant mouse (Logitech USB Optical Mouse USB Device), internal serial number: [ ], manufacturer ID: 046D, product ID: C018 |
When a USB smartphone is connected
Content | Notes |
Added USB (portable device) | Device name: Android Composite ADB Interface (Toshiba Corporation Toshiba HSUSB Device USB Device), internal serial number: TG12345678, manufacturer ID: 0930, product ID: 0D85 |
When a USB web camera is connected
Content | Notes |
Added USB (imaging device) | Device name: USB video device #2 (Alcor Micro, Corp. USB 2.0 PC Camera USB Device), internal serial number: [ ], manufacturer ID: 0458, product ID: 7081 |
When violated
When the device configuration change log becomes violated, the following message will be displayed.
[S105-ERR001] Accessing to this drive is prohibited by system administrator. (Drive:G)
[S105-ERR002] Access to this device has been prohibited by the system administrator. (Device:Y-E DATA USB-FDU USB Device)
