Windows Defender

For state auditing purposes I need Defender to auto-scan any USB device connected to a PC. I also need to be able to show that the scan is in fact kicking off automatically. I have made the registry changes for auto-scanning but I have yet to be able to "prove" that the scanning is taking place. Any help would be greatly appreciated. Thank you.

Hello TGaR74, and welcome.

Microsoft Defender should auto scan removable devices by default when connected if you have real-time protection turned on.

However, doing a "full scan" with Microsoft Defender will not include removeable drives unless enabled below first.

I have to be able to "prove" with documentation that these auto scans are taking place. Event Viewer is no help. Any idea where I could find log files or something stating the scan kicked off and completed the scan of the usb device?

Thank you for your time.