WinSecWiki > Security Settings > Advanced Audit Policies > Object Access > Removable Storage

Audit Removable Storage

In Windows Server 2012 and Windows 8, when a user attempts to access a removable storage device Success audit Event 4663 or Failure audits Event 4656 is generated each time. Failure events will not be generated unless Audit Handle Manipulation is also configured.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4656	A handle to an object was requested
4663	An attempt was made to access an object

Back to top

 

Upcoming Webinars Live, Hands-on Deep-Dive into LLM Hacking: Prompt Injection, Model Context Protocol and Skills AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves Linux Security: Locking Down Admin Access with SSH and Sudo Understanding Broken Object Level Authorization: The Quiet Access Control Failure Undermining Today’s Apps

Additional Resources