-1

I have admin rights to Windows server 2016(on virtual machine) with two partitions C:/ and D:/. On local disk D:/ web server is started.

The problem is that in event viewer security logs are spammed with Audit Success for every file in D:/. One more thing C:/ is on Disk0 and D:/ is in Disk1 causing event viewer to see this disk in task category: Removable Storage.

I can't use GPO config because the server is auto sync to DC.

Any idea how to strop audit tracking of D:/ on Disk1?

Can I use mountvol for that?

mountvol \\?\Volume{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} /d
Hristian Yordanov
  • 650
  • 1
  • 6
  • 25

1 Answers1

0

Try updating array controller driver and firmware. That worked for me.

Steve
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jun 18 '23 at 20:03