CD burn logging/monitoring on Windows
I know that Windows still does not have native functions for auditing CD burning events. In my specific environment, CD burning is the only allowed type of removable media, so we need better insight into it.
I've researched this religiously, and I know that Windows uses temp directories in C:\Users\[username]\AppData\Local\Microsoft\Windows\Burn as staging areas for files being burned, and then removes them after. There is also an event code 133 log that is created every time a burn happens, which states that the cdrom device was locked.
With all of that information, we are still struggling to find good methods for logging while files are being burned. Does anybody know of any ways to audit the actual files? We've found event ID 4911 sometimes works for some users on some workstations, but it seems inconsistent. I was hoping to use file creation events within the temp burn directories, but so far that has not seemed to pan out either.
Please let me know what you think. Thanks!