Troubleshooting

Removable Storage reports show no data

Symptom: The Removable Storage reports in ADAudit Plus are empty after configuration.

Resolution:

1. Verify audit policies: Run the following on the monitored computer and confirm both show Success and Failure or Success:

   auditpol /get /subcategory:"Removable Storage"
   auditpol /get /subcategory:"PNP Activity"

2. Verify registry value: Confirm HotPlugSecureOpen is set to 1 at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Storage.
3. Verify Security log events: Open Event Viewer on the monitored computer and check Windows Logs → Security for Event ID 4663 (file access) or Event ID 6416 (device plug-in).
4. Verify agent status: If using agent-based collection, confirm the ADAudit Plus agent is running on the monitored computer.
5. Verify computer selection: In ADAudit Plus, confirm the computer is added under Configuration → Data Sources (Member Servers or Endpoints as appropriate).

USB device name is not shown in reports

Symptom: Reports show removable storage events but the USB device name is missing.

Resolution:

1. Confirm the ADAudit Plus agent is installed on the monitored computer. Agent-based auditing is required to correlate USB device details with events.
2. Restart the ADAudit Plus agent service if it is running.
3. Wait for the next collection cycle and check the report again.

Device plug-in events are missing

Symptom: File read and modify events appear, but device plug-in events are not reported.

Resolution:

1. Confirm the monitored computer is running Windows 10 or Windows Server 2016 or later. Device plug-in events (Event ID 6416) are not supported on earlier versions.
2. Verify the Audit PNP Activity subcategory is enabled for both Success and Failure:

   auditpol /get /subcategory:"PNP Activity"

3. Check the Security log directly on the monitored computer for Event ID 6416.

Too many events in Removable Storage reports

Symptom: Reports contain excessive noise from routine removable storage use.

Resolution:

1. Identify the users, devices, or file types generating the most noise.
2. Navigate to Configuration tab → Report Profiles → View/Modify Report Profiles.
3. Adjust the report profile filters to exclude expected activity.
4. Alternatively, configure alert profiles to notify only on high-risk conditions.

Events appear on some computers but not others

Symptom: Removable storage events are collected from some monitored computers but not others.

Resolution:

1. Compare the audit policy settings on a working computer and a non-working computer:

   auditpol /get /subcategory:"Removable Storage"
   auditpol /get /subcategory:"PNP Activity"

2. Confirm the HotPlugSecureOpen registry value is set to 1 on the non-working computer.
3. Verify the ADAudit Plus agent is installed and running on the non-working computer.
4. Check the agent logs for errors related to event collection.

Frequently Asked Questions (FAQ)

Q1: Why is agent-based auditing recommended for removable storage? > Agent-based auditing correlates USB device details with Security log events, allowing ADAudit Plus to display the USB device name in reports. Agentless auditing cannot provide this correlation.

Q2: Can I monitor removable storage on Windows 7 or Windows Server 2008 R2? > File Read, File Modified, and File Copy and Paste events are supported on Windows 8 and Windows Server 2012 and later. Removable Device Plug In events require Windows 10 or Windows Server 2016 and later.

Q3: What is the HotPlugSecureOpen registry value and why is it needed? > HotPlugSecureOpen is a Windows registry value that forces Windows to apply security access checks when a removable storage device is hot-plugged. By default, hot-plugged devices bypass the Windows Security Reference Monitor, which prevents Event ID 4663 from being generated. Setting HotPlugSecureOpen to 1 enables reliable file access event generation for removable storage auditing. A system reboot is required after setting this value.

Q4: Can ADAudit Plus block or restrict USB device usage? > No. ADAudit Plus is an auditing and reporting tool. It does not enforce device control or block USB devices. Use a dedicated device control solution for enforcement.

Q5: Do file access events show the full file path or just the file name? > ADAudit Plus reports show the full object name recorded in Event ID 4663, which typically includes the drive letter and file path on the removable device. The drive letter is only available in reports when the ADAudit Plus agent is installed on the monitored computer.

Q6: Can I audit removable storage activity on domain controllers as well as workstations? > Yes. Removable storage auditing can be enabled on domain controllers, member servers, and workstations. Enable the Audit Removable Storage subcategory and add each computer type to ADAudit Plus as described in Sections 3, 4, and 5.

Q7: How do I tell whether a file was copied from the USB device to the computer, or from the computer to the USB device? > The object name in the event record identifies the file path on the removable device. A File Read event on a removable device path indicates data was read from the device (copied off). A File Modified or File Copy and Paste event on a removable device path indicates data was written to the device (copied on).

Q8: Why does File Copy and Paste appear as a separate event type from File Read or File Modified? > File Copy and Paste is a distinct report category that captures transfer operations between the removable device and the local file system. ADAudit Plus differentiates copy-and-paste activity from simple reads and writes based on the access patterns in Event ID 4663, providing a more accurate picture of data movement to and from the device.