# Ensure 'Audit Removable Storage' is set to 'Success and Failure'

Necessity: Auditing removable storage is critical for detecting and investigating potential data exfiltration or the introduction of malware. Unauthorized access to sensitive data via USB drives, external hard drives, or other removable media poses a significant security risk. Without this auditing, an organization would have a major blind spot in monitoring data flow and responding to security incidents involving physical media. A misconfiguration could allow malicious activity to go completely undetected. Auditing and Remediation: The audit script queries the system's advanced audit policy configuration using 'auditpol.exe' to determine the current auditing level for removable storage events. The remediation script uses the same utility to modify this setting, enabling auditing for successful access, failed access attempts, or both, thereby ensuring that all relevant activities are logged. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Success and Failure'. This is because any less comprehensive setting creates a significant security gap. Basic: 'Success and Failure' is the minimum acceptable configuration according to security benchmarks (e.g., CIS). Auditing successes logs when users access files, providing a trail of data handling. Auditing failures is equally important as it can indicate attempts to access restricted files or perform unauthorized actions. Moderate & Strict: For this specific control, 'Success and Failure' represents the most comprehensive and secure state. There is no intermediate or stricter configuration. Disabling either success or failure auditing would reduce visibility, which is unacceptable in environments that require moderate or strict security postures. Therefore, capturing both event types is essential for maximum security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Success and Failure']` |
| **Moderate** | `['Success and Failure']` |
| **Strict** | `['Success and Failure']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses the 'auditpol.exe' command to retrieve the current audit policy for the 'Object Access - Removable Storage' subcategory. The script must parse the output to isolate the 'Inclusion Setting' value and return only that string (e.g., 'Success and Failure', 'No Auditing', 'Success', or 'Failure').

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired audit level ('Success and Failure', 'Success', 'Failure', 'No Auditing'). The script must use 'auditpol.exe' to set the 'Removable Storage' subcategory policy by enabling or disabling auditing for success and failure events to match the input argument. The script must return '$true' upon successful execution of the command and '$false' on failure.

