Report used USB

[Ming Chou 0]

Hi,

We have enforced a policy to block all USB data storage, except ones we allow by name and model.

Now i want a report that shows who tried to use an USB besides our approved USB. see photo what i've created.

Now i want to either filter on "user" that contains, but when i add the filter and set it on "contains" i am only able to use one. Is it possible to use multiple ?

Option 2 would be to filter out the "NT Authority" but i cannot seem to find the correct filter for this.

[Marcos 5,731]

What about using "not equal" or "is not one of" for the user "NT Authority\System"?

[Ming Chou 0]

Hi Marcos,

It works, thank you so much.