audit

https://dotblogs.com.tw/tigerlin/2009/06/11/8778 https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=Auditpol https://serverfault.com/questions/802570/command-line-tool-for-listing-audit-policy-settings https://www.eventsentry.com/kb/410-how-to-get-notified-if-a-user-copies-a-file-to-a-removable-drive-e-g-usb-memory-stick https://my.stust.edu.tw/ma190206/doc/47194