17.6.4 L1) Ensure 'Audit Removable Storage' is set to 'Success and Failure' (Automated)

ObjectAccess_AuditRemovableStorage

Description

This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested.

Audit Policy CSP - Windows Client ManagementMicrosoftLearn

OMA-URI

./Device/Vendor/MSFT/Policy/Config/Audit/ObjectAccess_AuditRemovableStorage

Recommended Setting

Format: int Value: 3

Audit event on success and failure.

Settings Catalog

YES

Auditing

Audit Removable Storage