# Ensure 'Audit Removable Storage' is set to 'Success and Failure'

Necessity: Auditing removable storage is critical for monitoring and detecting potential data exfiltration or the introduction of malware via physical media like USB drives. This policy generates audit events when users attempt to access files and folders on removable storage devices. Without this auditing, an organization would have a significant blind spot, making it difficult to investigate incidents involving data theft or unauthorized software installation via such devices. Misconfiguration leaves the organization vulnerable to insider threats and external attacks that leverage physical access. Auditing and Remediation: The audit script leverages the native Windows 'auditpol.exe' utility to retrieve the current audit setting for the 'Removable Storage' subcategory within the 'Object Access' category. The remediation script uses the same utility to set the auditing level for success and failure events, based on the provided input parameter, thereby enabling or disabling the generation of specific security event logs. Recommended State Rationale: The recommendation for all levels is 'Success and Failure', aligning with security benchmarks like CIS. Basic: Setting the state to 'Success and Failure' is the foundational recommendation. It ensures that a complete log is kept, capturing both legitimate access (Success) and denied access attempts (Failure). Failure events are particularly important as they can indicate malicious probing or misconfigured permissions. Moderate: This level maintains the 'Success and Failure' configuration, as it is the most comprehensive and standard setting for environments requiring robust security monitoring. There is no meaningful intermediate state that provides adequate visibility. Strict: In a high-security environment, logging both successes and failures is non-negotiable. It provides the most complete data trail for forensic investigations, incident response, and threat hunting activities related to physical data transfer.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Removable Storage' audit policy setting. The script must use the 'auditpol.exe' command to get the current configuration for the subcategory 'Removable Storage' and parse the output to return only the value (e.g., 'No Auditing', 'Success', 'Failure', 'Success and Failure').

## Remediation Script Working

PowerShell script that configures the 'Removable Storage' audit policy. The script must accept a single command-line argument specifying the desired state ('No Auditing', 'Success', 'Failure', 'Success and Failure'). It will use 'auditpol.exe' to apply the corresponding success and/or failure auditing settings. The script must return '$true' on success and '$false' on failure or if the input is invalid.

