Security Event Logs Filling With Removable Storage (4658 & 4663) and Filtering Platform Connection (5156)

Question

Servers in our environment have their sec logs filled very quickly with a few event id's. At first I thought it was a GPO but I cannot find a GPO pushing Audit Filtering Platform or anything in the Sec Settings / Advanced Audit policy. When I look at the local policy on our boxes they all show "Not Configured" for these policies. I am scratching my head as to how these audits are being enabled, i need to either disable or reduce the verbosity because my logs are filling up in seconds.

Source: https://social.technet.microsoft.com/Forums/windowsserver/en-US/96a2f56a-848e-4290-a429-757482586b13/security-event-logs-filling-with-removable-storage-4658-amp-4663-and-filtering-platform?forum=winserverGP

Answer 1

Hello
Thank you for posting here.

1.On the machines that we can see these event ID (4663, 4658 and 5156), we can check the status of the related audit policy settings with the following command.
auditpol /get /category:*

For example:

2.We can also check if we configured the related audit policy settings through gpresult file.

Logon the machine that we can see these event ID (4663, 4658 and 5156) with Administrator.
Open CMD (run as Administrator) and type gpresult /h C:\audit.html and click Enter.
And open the audit.html and check the audit settings (including domain policy settings and local policy settings) under “Computer Details”, check if there are settings “Audit Removable Storage” and “Audit Filtering Platform Connection”.

For example:

3.On one problematic server, we can try to check if we can see the related audit policy settings ( “Audit Removable Storage” and “Audit Filtering Platform Connection”) in the following path:

\a.local\SYSVOL\a.local\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\Audit.csv

C:\Windows\security\audit.csv

{31B2F340-016D-11D2-945F-00C04FB984F9} is the GUID of the default domain policy.

The audit.csv look just like this:

Best Regards,
Daisy Zhou