WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Removable Storage

Audit Removable Storage

In Windows Server 2012 and Windows 8, when a user attempts to access a removable storage device Success audit Event 4663 or Failure audits Event 4656 is generated each time. Failure events will not be generated unless Audit Handle Manipulation is also configured.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID Title
4656 A handle to an object was requested
4663 An attempt was made to access an object

Back to top

 

Additional Resources