Auditing, Shadowing & Alerts View (devices)

 

There is a list of device types for which you can define user-level audit and shadowing rules and alerts.

 

Also, there is an extended audit's feature called data shadowing - the ability to mirror all data copied to external storage devices or transferred through serial and parallel ports. A full copy of the data is logged. The shadow log is stored locally in the special directory and then can be transferred to DeviceLock Enterprise Server to store it in the SQL database.

 

NOTE: You can define different online vs. offline audit and shadowing rules for the same user or sets of users. Online audit and shadowing rules (Regular Profile) apply to client computers that are working online. Offline audit and shadowing rules (Offline Profile) apply to client computers that are working offline. By default, DeviceLock works in offline mode when the network cable is not connected to the client computer. For more information on DeviceLock offline policies, see "DeviceLock Security Policies (Offline Profile)."

 

To define audit and shadowing rules for a device type, highlight it (use Ctrl and/or Shift to select several types simultaneously) and select Set Auditing, Shadowing & Alerts or Set Offline Auditing, Shadowing & Alerts from the context menu available by the right mouse click. Alternatively, you can press the appropriate button on the toolbar.

 

In DeviceLock Group Policy Manager and DeviceLock Service Settings Editor, if you want to reset online (regular) audit and shadowing rules to the unconfigured state, select Undefine from the context menu.

 

If you want to return previously defined offline audit and shadowing rules to the unconfigured state, select Undefine Offline from the context menu. If offline rules are undefined, regular rules are applied to offline client computers.

 

In DeviceLock Group Policy Manager and DeviceLock Service Settings Editor, if you want to block the inheritance of offline audit and shadowing rules and enforce regular audit and shadowing rules, select Remove Offline from the context menu.