Leave a comment

Microsoft EndPoint Manager (SCCM) gets live dashboard for USB removable storage security events

06/10/2020 – Brief Overview: secRMM is a Windows security solution that audits and controls access to removable storage devices.  secRMM is very easy to implement in that it can operate on a standalone Windows computer or can be centrally managed for thousands of computers.  It can be configured to have security policies for computers and/or groups of users.

YouTube Video at: https://youtu.be/vBinHpeqAl8

secRMM can be integrated directly into the SCCM console by installing the “secRMM SCCM console extension”.  The “secRMM SCCM console extension” now includes a “live” dashboard (i.e. charts showing you various aspects of your removable storage environment).  Microsoft has a specific location under the Monitoring->Security folder and this is also where you will find the “Removable Media Dashboard”.

An important note for all of the secRMM customers who do not use SCCM, the “Removable Media Dashboard” is also available without SCCM so you may use it as well!

Well, a picture is worth a 1000 words so below are some screen shots of the SCCM console.

RemovableMediaDashboard1

RemovableMediaDashboard1

RemovableMediaDashboard2

RemovableMediaDashboard2

If you will notice the green progress bar on each chart (under the title), this is where you can tell the charts to refresh themselves.  They can each be configured to different times depending on your environment.  You can rearrange the charts in any order you like just by dragging and dropping them.

Configuring the charts is also easy.  Below is the Settings window which gives you access to configuring the charts.

RemovableMediaDashboard3

RemovableMediaDashboard3

If you want the charts to not refresh automatically (like the other SCCM charts), just set the “Refresh time units” to “None”.

Those of you who are already using the “secRMM SCCM console extension” know that you can configure the “Removable Media security policies” for your environment in the SCCM console->”Assets and Compliance”->”Endpoint Protection”->”Removable Media Policies”.  Now, at that location, there is a new menu button called “Removable Media Dashboard”.  This is if you want to run the “Removable Media Dashboard” outside of the SCCM console.

RemovableMediaDashboard4

RemovableMediaDashboard4

If you run the “Removable Media Dashboard” outside of the SCCM console, you have the exact same functionality as within the SCCM console but you can also connect to different data sources (where your secRMM data resides).  The “Removable Media Dashboard” includes the following data sources:

  1. SCCM WQL
  2. SCCM Database (direct)
  3. secRMMCentral Database
  4. SCOM Database
  5. secRMM Event Log
  6. secRMMCentral Event Log
  7. Azure Log
RemovableMediaDashboard5

RemovableMediaDashboard5

We hope you find this new tool useful for your environment.  Please let us know what you think or if you have a requirement for a new chart.  You can get more details about secRMM and the “Removable Media Dashboard” by visiting https://www.squadratechnologies.com.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: