We have a setup with an application and device control policy that blocks all USB and we run a report every week of attempted USB's plugged into these machines. We've noticed that when we run the report from Monitors > Apllication & Device Control > Device Control > Device Control Disabled Device. The users it reports on the detail aren't always the user that plugged in the USB device but the previous user instead which makes trying to enforce users not to plug USB devices into these machines difficult.
Is there anyway to correct this reporting?
SEPM and all machines are 12.1 RU5