How to detect USB usage history using PowerShell and ADAudit Plus

Steps to obtain the USB usage history date using PowerShell:

• Identify the domain from which you want to retrieve the report.
• Identify the LDAP attributes you need to fetch the report.
• Identify the primary DC to retrieve the report.
• Compile the script.
• Execute it in Windows PowerShell.

Sample Windows PowerShell Script:

Get-ItemProperty -Path
'HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*' | Select FriendlyName

Sample output:

To obtain the report,

• Login to ADAudit Plus web console as an administrator.
• Navigate to the Server Audit tab and from the USB Storage Auditing section in the left pane, select Removable Device Plug In.
• Select the domain and click Generate.
• Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).
  

As you can see in the figure, ManageEngine ADAudit Plus provides an extensive yet simple report with all the details required for a system administrator to identify the source of a potential attack:

• The computer account name
• Date and time
• Domain name
• The type of external storage device used and its ID