[SOLVED] How to turn off Auditing

Dec 2, 2019
6
0
10
I have problem that everytime windows does security auditing it will start up all my idle HDDs every half hour so for me right now would be better to unplug them than trying to keep them idle.
 
Solution
the only storage I found you can turn the security audit off for is removable. Not internal.

If you have win 10 Pro you might be able to stop it via Group Policy but once again, I am not sure. You might want to ask on https://www.tenforums.com/ as that is where I go if I am not sure of an answer.

Colif

Win 11 Master
Moderator
I am curious why its running security auditing. I am one who prefers to figure out why its happening rather than just stop it.

figuring out what is running is the fun part
looks like it? https://www.eventtracker.com/blog/2...ovable-storage-with-the-windows-security-log/

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-removable-storage

not sure if that applies to internal drives though. I wish google didn't think It knew what I wanted.

have you looked to see what its doing each 30 minutes? = https://docs.microsoft.com/en-us/wi...otection/auditing/view-the-security-event-log

what AV do you use? if defender, you could always swap to something else like bitdefender free (link) and see if it stops the audits. Could be security logs aren't tied to AV though judging by topics here, it looks like it is - https://docs.microsoft.com/en-us/wi...rotection/auditing/security-auditing-overview
 
Last edited:
Dec 2, 2019
6
0
10
the drive will stay idle if it doesn't have any single file but if there is even one mp4 video it will start spinning up every about hour and process monitor sysinternals only shows security auditing.

only AV i have is windows' own

Edit.added AV
 
Dec 2, 2019
6
0
10
Actually that only happens when i open File explorer and doesn't spin up the drive but i wonder is it possible to make exception in security auditing for the drive i just hold pictures/videos or make it happen only when i try to access it