This is the log when device configuration is changed (when a memory device is added along with the change of drive letter, and when device name and internal serial number change because the device in the same drive letter is changed or a USB device is connected) in the client (CT).
Set policy for collection
Set policy in the Terminal Initial Settings window, the User Policy Settings window or the window after the Management Console is started (CT policy settings window).
In Windows > Log collection operation, set Device Configuration Change Log to Yes.
Collected information
The information displayed in Notes will be different due to the type of drive/device.
Drive/device type | Volume | Device Name/ Volume Name | Internal Serial Number, Manufacturer ID, Product ID | Server Name, Shared Name |
|---|---|---|---|---|
Fixed | Y | N | N | N |
Removable | N | Y (*1) | Y (*1) | N |
CD-ROM | N | Y (*1) | Y (*1) | N |
Remote (*2) | N | N | N | Y |
USB | N | Y (*1) | Y (*1) | N |
USB (portable device) | N | Y (*1) | Y (*1) | N |
USB (imaging device) | N | Y (*1) | Y (*1) | N |
Media | N | Y (*3) | Y | N |
Y: Collect information.
N: Do not collect information.
*1: The information is recorded only when a USB is connected.
*2: When sharing the floppy drive and USB memory device with another PC, the drive type will be recorded as "Remote".
*3: The volume name will be recorded when not blank.
Device type | Information displayed in Notes |
|---|---|
Wi-Fi connection | Access point BSSID, Access point SSID, DNS server IP address |
Bluetooth | Device name, Device type, MAC address |
PC card | Device name, Hardware ID |
Media | Total capacity: [XX] MB, Used capacity: [XX] MB, Media name (*4) |
*4: Only media for which media individual identification has been performed will be recorded.
Displayed content
The following log content can be viewed:
Name: name of the client (CT)
Occurrence Date and Time: time for collecting logs at client (CT)
User ID: logon user name of the client (CT)
Domain Name: it is the domain name of the client (CT) when logging on to domain while it is the computer name of the client (CT) when logging on to local computer
Type: Device Configuration Change (fixed value)
Classification: Normal or Violation (*7)
Attachment: (not displayed)
Content: the following content is displayed.
Add or Change (*5)
Drive letter, USB, or media (*5)
Drive type or portable device/imaging device type (*5)
*5: When performing keyword search in Log Viewer, the value in [ ] can be specified as keyword.
Recorded as Add in the following cases:
When registering a device configuration change log for the drive letter
When logging on, if there is drive added comparing the information at last logoff with the current drive information
When adding device in the logon status
When logging on after adding device in the status of not logon
When removing the connected device and connecting another device to the same drive in the logon status
When registering a USB device configuration change log
On startup of the PC, if there is a device added when comparing the information at last shutdown with the current USB device information
When a USB device is added after starting up the PC (obtained even when not logged in)
When registering a media device configuration change log
On startup of the PC, if there is media added when comparing the information at last shutdown with the current media information
When media is added after starting up the PC (obtained even when not logged in)
Point
A media device configuration change log is recorded only for media connected to a USB set in Individually identify media in the Device/Media Registration window.
When registering a USB device in the Device/Media Registration window, if connecting media to a USB device for which Not Available is selected in Device/Media Identification Method, a media device configuration change log will not be registered.
If media is connected to a USB device for which the period for use has expired, this will be recorded as a "Violation" in the media device configuration change log.
When recording a device configuration change log for the following device types:
Wi-Fi connection
Bluetooth
PC card
Record as Change when any of the following operations is performed in the logon status.
When registering a device configuration change log for the drive letter
When changing the drive type
When allocating the shared name of server to the existing network drive
When registering a USB device configuration change log
Not recorded as "Change".
Note: the following content is displayed:
Volume (*6)
Device name (*6)
Internal serial number (*6)
Server name, shared name (*6)
USB device name (*8)
Manufacturer ID
Product ID
Access point BSSID (*6)
Access point SSID (*6)
DNS server IP address (*6)
Wi-Fi connection target name (*9)
Device type (*6)
MAC address (*6)
Hardware ID (*6)
Name (*10)
Total capacity (*6)
Used capacity (*6)
Media name (*4)
*6: When performing keyword search in Log Viewer, the value in the [] can be specified as a keyword.
*7: The situation of recording as a violation will be different due to the status of policy, whether to reflect policy, whether the Management Server can be communicated with and the status of the connected USB device. Recording as a violation occurs when Individual identification is set to Use, and the following pattern applies. Even when access is set as prohibited for non-USB connections (IDE connection, IEEE connection, PCMCIA connection, etc.) of removable devices or DVD/CD devices, such connections are recorded as normal.
Case 1
When the USB device whose Device/Media Identification Method in the Device/Media Registration window is Not Available is connected
Case 2
When the USB device whose period for use set in Deadline of Device/Media Use in the Device/Media Registration window has expired is connected
Case 3
When Allow to Use All USB Registered in Management Server of the File Export Prohibition > Individual identification feature > Detailed Settings window is set to Yes, the Management Server cannot be connected to the client (CT)
Case 4
When you select Export Prohibition (specify drive, removable, or DVD/CD) in File export/read and connect to a USB device that has not been permitted for use
Note that drive specification is recorded as normal in the USB device configuration change log.
Case 5
When you select Reading prohibition (specify removable or DVD/CD) in File export/read and connect to a USB device that has not been permitted for use
Pattern 6
When you select Portable device/imaging device connection prohibition in File export/read (specify portable device, or imaging device), and connect to a USB device that has not been permitted for use
*8: When Individual identification is set to Use, the USB device name will be obtained.
*9: When a Wi-Fi connection destination is registered in Wi-Fi Connection Target Permission Settings, the destination will be obtained.
*10: When a device is registered in PC Card Device Permission Settings, the name will be obtained.
Example of Content and Notes:
When the information cannot be obtained, blank ([ ]) will be displayed.
When built-in hard disk is installed
Content | Notes |
|---|---|
Add D: fixed | Volume Windows2008 |
When viewing the drive information in Explorer of OS, in case that "Local Disk (D:)" is displayed, the volume is displayed as blank ([ ]).
When USB memory device, hard disk and floppy drive, etc., connected via USB are connected
Content | Notes |
|---|---|
Add G: Removable | Device Name BUFFALO USB Flash Disk USB Device, Internal Serial Number B32986, Manufacturer ID: 1111, Product ID: 2222 |
When DVD/CD device connected via USB is connected
Content | Notes |
|---|---|
Add E: CD-ROM | Device Name MATSHITA UJD330, Internal Serial Number [ ], manufacturer ID: 3333, product ID: 4444 |
For DVD/CD device not connected via USB (via IDE, IEEE, etc.), blank will be displayed in the notes column.
When network drive is added
Content | Notes |
|---|---|
Add G: Remote | Server Name, Shared Name \\ServerSOUMU\SOUMUDISK |
"Server Name, Shared Name" may also be displayed as "\\IP Address of the Server\Shared Name".
When individual identification of USB device is performed and the unauthorized USB device (identified as removable) is installed
Classification | Content | Notes |
|---|---|---|
Violation | Added G: Removable | Device Name BUFFALO USB Flash Disk USB Device, Internal Serial Number B32986, Manufacturer ID: 1111, Product ID: 2222 |
When the hard disk is physically damaged, and other applications exclusively access the file that records the previous device configuration, Content of device configuration change log may become "Unknown".
Content | Notes |
|---|---|
Modify A:Unkown->Removable |
When a USB mouse is connected
Content | Notes |
|---|---|
Added USB | Device name: HID-compliant mouse (Logitech USB Optical Mouse USB Device), internal serial number: [ ], manufacturer ID: 046D, product ID: C018 |
When a USB smartphone is connected
Content | Notes |
|---|---|
Added USB (portable device) | Device name: Android Composite ADB Interface (Toshiba Corporation Toshiba HSUSB Device USB Device), internal serial number: TG12345678, manufacturer ID: 0930, product ID: 0D85 |
When a USB web camera is connected
Content | Notes |
|---|---|
Added USB (imaging device) | Device name: USB video device #2 (Alcor Micro, Corp. USB 2.0 PC Camera USB Device), internal serial number: [ ], manufacturer ID: 0458, product ID: 7081 |
When connected via Wi-Fi
Content | Notes |
|---|---|
Add Wi-Fi connection | Access point BSSID: [00:11:22:33:44:55], Access point SSID: [Osaka-branch-A101], DNS server IP address: [192.168.0.101], Wi-Fi connection target name: [Osaka branch meeting room A101] |
When connected via Bluetooth
Content | Notes |
|---|---|
Add Bluetooth connection | Device name: [Keyboard000], Device type: [Peripheral], MAC address: [55:44:33:22:11:00] |
When using PC card
Content | Notes |
|---|---|
Add PC card | Device name: [PCCARD Device], Hardware ID: [123456790], Name: [Sales department No05] |
When media is used
Content | Notes |
|---|---|
Add Media | Total capacity: [2,048] MB, Used capacity: [1] MB, [Fujitsu SD Media1] |
When violated
When the device configuration change log becomes violated, the following message will be displayed.
[S105-ERR001] Accessing to this drive is prohibited by system administrator. (Drive:G)
[S105-ERR002] Access to this device has been prohibited by the system administrator. (Device:Y-E DATA USB-FDU USB Device)
[S105-ERR003] Access to this access point has been prohibited by the system administrator. (access point :Free-Spot)
[S105-ERR004] Access to this media has been prohibited by the system administrator.
