Getting logs of files copied away from a laptop

Question

Is there a group policy setting to monitor external storage usage rather than outright blocking the use. we want to be able to know which files are being copied away from the system.
Liyide, A.G.

Answer 1

You may simply enable and apply a GPO security setting to audit the object access, and then make the GPO link to the container which contains the file server that you want to audit.
The configuration node of GPO : Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit object access
http://blogs.technet.com/b/mspfe/archive/2013/08/27/auditing-file-access-on-file-servers.aspx
You may enable auditing both success and failure attempts on the setting for the security consideration.
For enabling the audit settings on a stand-alone server, please refer to :
Configuring Audit Policies :
http://technet.microsoft.com/en-us/library/dd277403.aspx
Apply or modify auditing policy settings for a local file or folder :
http://technet.microsoft.com/en-us/library/cc784387.aspx
If you want to track such activities automatically, you may also check
LepideAuditor for File server that could be a good alternative approach for you.
Lepide - Simplifying IT Management