Hide this message
Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.
Use the Windows active response to detach a USB device from a LEM agent running USB Defender. This action is useful for allowing only specific devices to be attached to your Windows computers or detaching any device exhibiting suspicious behavior, and can be automated in a LEM rule, or executed manually from the Respond menu in LEM Console > Node List.
USB Defender is an option when the agent is originally installed. If not installed at the time of agent install, re-install the agent with USB Defender. Additionally, configure the Windows Active Response tool on each LEM agent where you require an active response.
If you have a long list of nodes, filter your list using the Node, OS, or USB drop-down menus.
You can install USB Defender only on Windows agents.
Windows Active Responsein the Refine Results search box.
By default, USB devices are audited and the USB File Audit Activity filter will display those events. The filter is set for
FileAuditAlerts.ProviderSID=*USB* To monitor all USB device activity, create a filter for
USB devices are not detached by default. You must configure a rule to detach the device. The Templates grid includes several templates you can clone and modify as needed.
You can enforce USB Defender policy locally using the USB Defender local policy connector.