windows-itpro-docs/windows/device-security/auditing/audit-removable-storage.md

title, description, ms.assetid, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author, ms.date

title	description	ms.assetid	ms.pagetype	ms.prod	ms.mktglfcycl	ms.sitesec	author	ms.date
Audit Removable Storage (Windows 10)	This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive.	1746F7B3-8B41-4661-87D8-12F734AFFB26	security	w10	deploy	library	Mir0sh	04/19/2017

Audit Removable Storage

Applies to

• Windows 10
• Windows Server 2016

Audit Removable Storage allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated for all objects and all types of access requested, with no dependency on object’s SACL.

Computer Type	General Success	General Failure	Stronger Success	Stronger Failure	Comments
Domain Controller	Yes	Yes	Yes	Yes	This subcategory will help identify when and which files or folders were accessed or modified on removable devices. It is often useful to track actions with removable storage devices and the files or folders on them, because malicious software very often uses removable devices as a method to get into the system. At the same time, you will be able to track which files were written or executed from a removable storage device. You can track, for example, actions with files or folders on USB flash drives or sticks that were inserted into domain controllers or high value servers, which is typically not allowed. We recommend Failure auditing to track failed access attempts.
Member Server	Yes	Yes	Yes	Yes
Workstation	Yes	Yes	Yes	Yes

Events List:

• 4656(S, F): A handle to an object was requested.

• 4658(S): The handle to an object was closed.

• 4663(S): An attempt was made to access an object.