WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Removable Storage

Audit Removable Storage

In Windows Server 2012 and Windows 8, when a user attempts to access a removable storage device Success audit Event 4663 or Failure audits Event 4656 is generated each time. Failure events will not be generated unless Audit Handle Manipulation is also configured.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4656	A handle to an object was requested
4663	An attempt was made to access an object

Back to top

 

Upcoming Webinars AI Security Hands-On: Understanding and Red Teaming the LLM as a Black Box Rethinking Privileged Access for the Age of AI-Powered Attacks Inside Entra ID Authentication: How Tokens, MFA, and Conditional Access Work and Where Attackers Break the Chain Understanding Entra Privileged Identity Management, What PIM Covers and Where It Stops

Additional Resources