Question

You work as the IT Administrator for a small corporate network. As part of your ongoing program to improve security, you would like to enable auditing for removable storage devices on all workstations. You want an audit event each time a user accesses or attempts to access a file system object on a removable storage device.

Your task is to add Object Access auditing for removable storage to the WorkstationGPO policy object on CorpDC.

Answer 1

To enable auditing for removable storage devices on all workstations, you need to add Object Access auditing to the Workstation PO policy object on Corp DC. Follow these steps to configure the auditing settings and receive audit events when users access or attempt to access file system objects on removable storage devices.

Step-by-step explanation:

To enable auditing for removable storage devices on all workstations, you need to add Object Access auditing to the Workstation PO policy object on Corp DC. This can be done by following these steps:

1. Log in to the Corp DC server as an administrator.
2. Open the Group Policy Management Console.
3. Navigate to the desired Group Policy Object (GPO) that is linked to the workstations.
4. Right-click on the GPO and select 'Edit'.
5. In the Group Policy Management Editor, go to 'Computer Configuration' > 'Policies' > 'Windows Settings' > 'Security Settings' > 'Advanced Audit Policy Configuration' > 'Object Access'.
6. Double-click on 'Audit Removable Storage'.
7. Select the desired settings for auditing removable storage, such as 'Success' and 'Failure'.
8. Click 'OK' to save the changes.
9. Close the Group Policy Management Editor.
10. Link the GPO to the appropriate organizational unit (OU) containing the workstations.

Once the changes are applied, auditing for removable storage devices will be enabled on all workstations, and you will receive an audit event each time a user accesses or attempts to access a file system object on a removable storage device.