WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Removable Storage
Audit Removable Storage
In Windows Server 2012 and Windows 8, when a user attempts to access a removable storage device Success audit Event 4663 or Failure audits Event 4656 is generated each time. Failure events will not be generated unless Audit Handle Manipulation is also configured.
Coverage on events generated by this category are currently in the Security Log Encyclopedia:
Back to top