@Hacker you can use the below powershell script to monitor for when the usb disconnects. When it detects a usb disconnection event, it will shutdown the storagenode. All you have to do is change the $driveLetter -eq ‘D:’ with the Letter of your usb drive.
I know it is not a solution but it helps prevent those audit errors. If you combine this with uptimerobot monitoring you should get notified since the storagenode goes offline.
Register-WmiEvent -Class win32_VolumeChangeEvent -SourceIdentifier volumeChange
write-host (get-date -format s) " Beginning script..."
do{
$newEvent = Wait-Event -SourceIdentifier volumeChange
$eventType = $newEvent.SourceEventArgs.NewEvent.EventType
$eventTypeName = switch($eventType)
{
1 {"Configuration changed"}
2 {"Device arrival"}
3 {"Device removal"}
4 {"docking"}
}
write-host (get-date -format s) " Event detected = " $eventTypeName
if ($eventType -eq 3)
{
$driveLetter = $newEvent.SourceEventArgs.NewEvent.DriveName
#$driveLabel = ([wmi]"Win32_LogicalDisk='$driveLetter'").VolumeName
write-host (get-date -format s) " Drive name = " $driveLetter
#write-host (get-date -format s) " Drive label = " $driveLabel
#Execute process if drive matches specified condition(s)
if ($driveLetter -eq 'D:')
{
write-host (get-date -format s) " Starting task in 3 seconds..."
start-sleep -seconds 3
Stop-Service storagenode
}
}
Remove-Event -SourceIdentifier volumeChange
} while (1-eq1) #Loop until next event
Unregister-Event -SourceIdentifier volumeChange