How to disable Audit Removable Storage on partition D:\

Question

I have admin rights to Windows server 2016(on virtual machine) with two partitions C:/ and D:/. On local disk D:/ web server is started.

The problem is that in event viewer security logs are spammed with Audit Success for every file in D:/. One more thing C:/ is on Disk0 and D:/ is in Disk1 causing event viewer to see this disk in task category: Removable Storage.

I can't use GPO config because the server is auto sync to DC.

Any idea how to strop audit tracking of D:/ on Disk1?

Can I use mountvol for that?

mountvol \\?\Volume{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} /d

Answer 1

Try updating array controller driver and firmware. That worked for me.