Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Removable Storage Auditing. Removable Storage Auditing helps you monitor the use of USB drives, external hard drives, mobile phones, and other removable media across your Windows domain controllers, servers, and workstations. Follow this workflow before relying on removable storage reports:

• Add domain controllers, Windows servers, and workstations to ADAudit Plus.
• Enable the required audit policies on each monitored computer type.
• Configure the HotPlugSecureOpen registry setting on monitored computers.
• Verify that removable storage events are generated and collected.

What is removable storage auditing

Removable Storage Auditing tracks how users interact with removable storage devices on your network. ADAudit Plus collects events from the Windows Security event log and presents them in reports that show file reads, modifications, copy-and-paste operations, and device plug-in events. This helps enforce compliance with regulations such as HIPAA and GDPR and detect data exfiltration attempts.

How removable storage auditing works

ADAudit Plus removable storage auditing covers two distinct feature areas. Understanding the difference helps you configure and verify auditing correctly.

Feature 1: Device connections

When a user connects a removable storage device to a monitored computer, Windows records Event ID 6416 in the Security log. ADAudit Plus collects this event and presents it as a Removable Device Plug In record showing the user, computer, device name, and time of connection.

The ADAudit Plus agent enriches these records by correlating the Security log event with device details on the host — this is why the USB device name only appears in reports when the agent is installed.

Feature 2: File access auditing

When a user reads, modifies, or copies a file on a removable device, Windows records Event ID 4663 in the Security log. ADAudit Plus classifies these file access events into three types based on the access rights mask recorded in the event:

• File Read — the file on the removable device was opened with read-only access.
• File Modified — the file on the removable device was opened with write access.
• File Copy and Paste — files were transferred to or from the removable device. ADAudit Plus identifies copy-and-paste operations based on access patterns in Event ID 4663 that indicate a file transfer between the removable device and the local file system.

Note: File access events (Event ID 4663) require Windows 8 or Windows Server 2012 or later.

Supported devices and events

ADAudit Plus supports auditing of the following removable storage devices:

• USB flash drives
• External hard drives
• Mobile phones
• CDs and DVDs
• Micro-SD cards
• WPD devices (Windows Portable Devices)

Event	Windows Event ID	Description	Supported OS
File Read	4663	A file on a removable device is read.	Windows 8+ / Windows Server 2012+
File Modified	4663	A file on a removable device is modified.	Windows 8+ / Windows Server 2012+
File Copy and Paste	4663	Files are copied or pasted to or from a removable device.	Windows 8+ / Windows Server 2012+
Removable Device Plug In	6416	A removable device is connected to a computer.	Windows 10+ / Windows Server 2016+

Agent-based vs agentless auditing

Important: Agent-based auditing is strongly recommended for removable storage auditing. Without the agent, the USB device name will not appear in reports and event collection reliability is reduced.

Capability	Agent-based	Agentless
USB device name shown in reports	✅ Yes — agent correlates device details with events	❌ Not available
Events when object name includes drive letter	✅ Yes	❌ Not available
Reliability	High — events collected locally	Lower — depends on remote event log access

Tip: Use agent-based auditing wherever possible to ensure complete and accurate removable storage event collection.