Hi all,
My friend works in an IT company. Plugging USB pen drives is not allowed in his company. When he is on Windows Machine and if he inserts his USB pen drive, it comes into the notice of Sys Admins coz a policy has been applied on USB devices as a result of which log is generated on the server.

This is possible because the employees have to login using an id provided by the company and the Sys Ads can make out which employee did what?

This however is possible only on Windows since on Linux he logins as a root. So his machine does not come into the company domain. Also there are no Scripts installed on his machine that will notify Sys Ads.

So the bottom line is my Friend can use his Pen drive in Linux and not on Windows.

However every now and then there are audits in his company where they check the log files of each and every machine. My question is, which are the log files that may contain traces of the fact that USB devices where inserted into the machine. Just let me know those files so that my friend can clear those logs.

This sounds ridiculously counter to the policies and intentions of company rules put in place for a reason. I believe that it would be quite innapropriate for an LQ member to assist you and/or your friend in altering system logs on production systems in use at his workplace.
Suggest that your friend follow the rules, so that he may continue to enjoy his job for a long time.

For reasons already stated by GrapefruiTgirl, this thread is closed.