I want to know what happens in my USB Devices (file creation, file renamed, etc) without using an external tool.

I'm using Windows 7, can I enable some GPO to log these actions?

Here the event 4663 is used. Can I use something like this on Windows 7 or Windows 2008?


Without third party tools, no, it's not possible - the functionality was only introduced in Windows Server 2012, and subsequent releases: see Microsoft Technet for details (under the section header "What is the difference between audit policies located in Local Policies\Audit Policy and audit policies located in Advanced Audit Policy Configuration?" for some reason).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.