Skip to content
LEGIT AIDOCS
Open the console

USB control

See every storage device plugged into a Windows machine, approve the ones people need by serial number, and switch USB storage off on a machine when it has to be.

USB Control works on Windows machines with the agent. It needs the PNP Activity audit subcategory, which the agent’s installer turns on — Windows then writes event 6416 every time a device is plugged in.

Which devices raise alerts

Section titled “Which devices raise alerts”

For every device that appears, the platform asks three questions in turn:

  1. Is it storage? A keyboard, mouse or headset is recorded and never raises an alert.
  2. Can it be identified? Approvals are given to a serial number. A storage device that reports no serial cannot be matched, so it counts as unapproved — “we could not tell” never reads as “it was fine”.
  3. Is it approved, and is the approval still valid? An expired approval is not an approval.

An unapproved storage device raises an alert. An approved one is recorded and stays quiet — no rule tuning, no suppression to remember to remove.

Asking and approving

Section titled “Asking and approving”
  • Anyone in the tenant can ask to use a device, and can see what has been plugged into the machines.
  • An ADMIN decides: approve, deny, or later revoke. An approval can carry an expiry date. Each decision is written to the audit log with who asked, who decided and why.

Switching USB storage off

Section titled “Switching USB storage off”

An ADMIN can switch USB mass storage off on one machine. The agent sets the USBSTOR service to disabled (Start = 4) in the registry: storage devices stop mounting, while keyboards, mice and other devices keep working. No kernel driver is involved.

Blocking waits for a second ADMIN’s approval, like any other response action, because a block on a misidentified device is first discovered by someone who can no longer do their work. Switching it back on needs no second signature.