WinSecWiki > Security Settings > Local Policies > Audit Policy > Process Tracking > Removable Storage Devices

Removable Storage Devices

In Windows Server 2012 and Windows 8, when a user attempts to access a removable storage device Success audit Event 4663 or Failure audits Event 4656 is generated each time. Failure events will not be generated unless Audit Handle Manipulation is also configured.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID Title
4656 A handle to an object was requested
4663 An attempt was made to access an object

Back to top


Additional Resources