Windows Events created by Endpoint Encryption Removable Media Encryption
Article ID: 188253
Windows events that are created when a file is encrypted by Endpoint Encryption Removable Media Encryption.
Release : 11.3
Component : Endpoint Encryption Removable Media Encryption
Right clicking on a file stored on removable media and choosing to encrypt the file results in Event ID 702 in the Windows Application Event Viewer.
Creating a new file on the removable media or copying a file to removable media results in Event ID 701 in the Windows Application Event Viewer.
Both events have the Source: Removable Media Encryption.