> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# USB Device Monitoring & Blocking
> Syteca USB Device Control: detect, audit, and block removable media on Windows and macOS endpoints, with administrator approval workflow for one-off access.
## Stop data walking out the door on a thumb drive
A single USB stick can carry every customer record, every line of source code, every signed contract you have. It bypasses the network, leaves no log on the firewall, and once it's in someone's pocket the data is gone. Removable media is one of the oldest data-exfiltration paths and still one of the hardest to close — because some users genuinely need it, and you can't just glue every port shut.
Tools that *only* block USB ports outright are too crude for most real environments: the finance team needs their license dongle, the design lead needs to plug in a Wacom tablet, the CEO doesn't want to call IT every time they bring a presentation in on a stick. Free `auditd` USB rules give you a log entry, but no block, no approval workflow, and no record of what was on the drive.
**Syteca USB Device Control** sits in the middle: every USB device plugged into a Windows or macOS endpoint is **automatically detected and logged** to the [Session Viewer](/docs/session-monitoring/player/overview), and you add **rules** for the device classes you want to alert on, **block**, or **gate behind administrator approval**. Permitted devices (the license dongle, the Wacom, the CEO's USB-C dock) go on an **exceptions list** by Hardware ID so they keep working. The result: an auditable record of every removable device, a hard block on what shouldn't be allowed, and a controlled escape hatch for the exceptions.
**Use USB Device Control when you need to:**
* Prevent data exfiltration to USB drives, external SSDs, and SD cards — at the kernel level, not via Group Policy.
* Get a continuous audit log of every USB device plugged into every monitored endpoint.
* Block specific device classes (mass storage, modems, wireless adapters, vendor-specific) without breaking keyboards, mice, and approved peripherals.
* Offer a controlled "request access" workflow for legitimate one-off USB use, instead of permanent allow lists.
* Meet the removable-media control requirements in PCI DSS, HIPAA, NIST 800-53, ISO 27001, and SOC 2.
**Pair it with [Session Monitoring](/docs/session-monitoring/overview)** — USB events show up alongside the recorded session so you can see *what the user did with the device* once they plugged it in, not just that it was connected.
This page is the conceptual reference. To define and assign rules, see [USB monitoring rules](/docs/session-monitoring/usb-devices/usb-rules); to set up the user-facing approval workflow, see [USB access approval](/docs/session-monitoring/usb-devices/usb-access-approval).
## How USB monitoring works
Syteca offers two layers of USB detection, which work together.
| | Automatic monitoring | Rule-based monitoring |
| -------------------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| **Setup needed** | None — on by default | Add USB monitoring rules |
| **What it captures** | Every storage-class device plugged in (drives, cards, cameras, phones) | Any device class you choose to monitor |
| **Where the data appears** | [Session Viewer](/docs/session-monitoring/player/overview) | [Session Viewer](/docs/session-monitoring/player/overview) and the [Alerts](/docs/session-monitoring/alerts) tab |
| **Can it block?** | No — observe only | Yes (Windows only) — block, or block-until-approved |
| **Can it notify?** | No | Yes — email and/or [Tray Notifications](/docs/administration/deployment/tray-notifications) |
| **Windows support** | ✓ | ✓ |
| **macOS support** | ✗ Not currently | ✓ Mass storage and Vendor-specific only |
In short: automatic monitoring gives you the always-on audit log; rule-based monitoring gives you the targeted alerting, blocking, and approval workflow on top.
Some advanced actions — blocking, block-until-approval, and notifying the user on the target computer — are **not currently supported for macOS Clients**. On macOS, only the **Mass storage devices** and **Vendor-specific devices** classes can be monitored or alerted on.
## Automatically monitored devices
When automatic monitoring is on (the default for Windows Clients), the following USB device types are detected and logged to the Session Viewer with no further configuration:
* External magnetic hard drives
* External optical drives (CD, DVD)
* Portable flash memory devices and USB drives
* Solid-state drives
* USB-to-memory-card adapters
* Digital cameras
* Digital audio and portable media players
* Card readers
* PDAs
* Mobile phones
## USB device classes available for rule-based monitoring
When you add a [USB monitoring rule](/docs/session-monitoring/usb-devices/usb-rules), you choose which **device classes** the rule applies to. Each class covers a range of device types:
| Device class | What's included | macOS support |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------- |
| **Mass storage devices** | External hard drives, optical drives, flash drives, SSDs, USB-to-memory-card adapters, digital cameras, audio/media players, card readers, PDAs | ✓ |
| **Portable devices** | Audio players, phones, and other devices using non-standard identifiers | ✗ |
| **Wireless connection devices** | Bluetooth adapters, Microsoft RNDIS | ✗ |
| **Modems and Network adapters** | Network interface controllers | ✗ |
| **Audio devices** | Speakers, microphones, sound cards, MIDI devices | ✗ |
| **Video devices** | Web cameras | ✗ |
| **Human interface devices** | Keyboards, mice, joysticks | ✗ |
| **Printers** | Laser printers, inkjet printers, CNC computers | ✗ |
| **Composite devices** | Devices combining multiple device types (e.g. keyboards with USB ports) | ✗ |
| **Vendor-specific devices** | Devices needing vendor-specific drivers (e.g. mobile phones) — class is defined by the vendor | ✓ |
Selecting **Vendor-specific devices** can result in *all* USB devices being blocked, since many devices identify themselves under a vendor-specific class. Always pair this with a complete [exceptions list](/docs/session-monitoring/usb-devices/usb-rules#define-exceptions) of permitted Hardware IDs to avoid an outage.
**Always add permitted devices to the exceptions list before activating a blocking rule.** A blocking rule with no exceptions can lock out the keyboards and mice your users need to recover.
## Find a device's class (Windows)
To identify what device class a specific USB device reports as — useful when planning rules and exceptions — view its Compatible IDs in Device Manager:
Plug the USB device into your Windows computer.
Right-click **This PC** and select **Manage**.
Click the **Device Manager** node (under **System Tools**).
Expand the node with the computer's name, then expand **Universal Serial Bus Controllers**.
Right-click the device, choose **Properties**, select the **Details** tab, then select **Compatible Ids** in the **Property** drop-down. The class appears in the **Value** field.
Each class has a numeric name (e.g. `00`, `01`, `02`). The official list is maintained by the USB Implementers Forum at [usb.org/defined-class-codes](https://www.usb.org/defined-class-codes); Wikipedia's [USB article](https://en.wikipedia.org/wiki/USB) is a more readable cross-reference.
## The USB Devices page
Once rules are added, they're listed on the **USB Devices** page in the Management Tool. The grid shows:
| Column | What it shows |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name** | The rule name. |
| **Description** | Optional description of the rule. |
| **Risk Level** | The risk level set on the **USB Rule Properties** tab. |
| **State** | Whether the rule is **Enabled** or **Disabled**. |
| **Action** | The actions configured on the **Additional Actions** tab. **Alert** means the rule sends email or Tray notifications; **Block** means a blocking action is selected. |
| **Assigned To (Client Group)** | The Clients and/or Client groups the rule applies to. |
Rules can only be added or edited by users with the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions).
If a Client is reinstalled while a USB device is connected — and a rule blocks that device — blocking will not take effect until the Client computer is restarted.
## Related
Add, edit, delete rules, plus exceptions and finding the Device Hardware ID.
Configure and use the request-and-approve workflow for blocked devices.
See USB events alongside the recorded session in the Session Viewer.
Where USB rule events appear alongside other endpoint alerts.