Usage: AuditPol command []
Commands (only one command permitted per execution)
/? Help (context-sensitive)
/get Displays the current audit policy.
/set Sets the audit policy.
/list Displays selectable policy elements.
/backup Saves the audit policy to a file.
/restore Restores the audit policy from a file.
/clear Clears the audit policy.
/remove Removes the per-user audit policy for a user account.
/resourceSACL Configure global resource SACLs
Use AuditPol /? for details on each command
Usage: AuditPol /list
[/user|/category|/subcategory[:|<{guid}>|*]
[/v] [/r]
This command lists audit policy categories, subcategories, or lists users for
whom per-user audit policy is defined.
Commands
/? Help (context-sensitive)
/user Retrieves all users for whom per-user audit policy
has been defined. If used with the /v option, the
sid of the user is also displayed.
/category Displays the names of categories understood by the
system. If used with the /v option, the category
GUID is also displayed.
/subcategory Displays the names of subcategories understood by the
system, for subcategories in a specified category.
The subcategory GUIDs are also displayed if the /v
option is used.
Example:
auditpol /list /user
auditpol /list /category /v
auditpol /list /subcategory:"Detailed Tracking","Object Access"
Usage: AuditPol /clear [/y]
This command deletes per-user audit policy for all users, resets system
audit policy for all subcategories and sets all the auditing options to disabled.
Options
/? Help (context-sensitive).
/y Suppresses the prompt to confirm if all the audit policy
should be cleared.
Example:
auditpol /clear
auditpol /clear /y
Usage: AuditPol /remove [/user[:|<{sid}>]]
[/allusers]
This command removes per-user audit policy for a specified account.
Options
/? Help (context-sensitive).
/user Specifies the SID or user name for the user for whom
per-user audit policy is to be deleted
/allusers Deletes per-user audit policy for all users.
Example:
auditpol /remove /user:{S-1-5-21-397123417-1234567}
auditpol /remove /allusers
Usage: AuditPol /backup /file:
This command backs up system audit policy settings and per-user audit policy
settings for all users and all auditing options into a file. The backup will
be written to a CSV-formatted text file.
Options
/? Help (context-sensitive).
/file Specifies the name of the file to which the audit policy
will be backed-up.
Example:
auditpol /backup /file:c:\auditpolicy.csv
Usage: AuditPol /restore /file:
This command restores system audit policy settings, per-user audit policy
settings for all users and all auditing options from a file created with the
/backup command.
Options
/? Help (context-sensitive).
/file Specifies the file where the audit policy should be
read from. The file must have been created by the
/backup option or must be syntactically consistent
with that file format.
Example:
auditpol /restore /file:c:\auditpolicy.csv
Usage: AuditPol /resourceSACL
[/set /type: [/success] [/failure] /user:
[/access:] [/condition:]]
[/remove /type: /user: [/type:]]
[/clear [/type:]]
[/view [/user:] [/type:]]
This command configures settings for global object access auditing. The
corresponding object access subcategory needs to be enabled for the events
to be generated by the system. Type auditpol /set /? for more information.
Commands
/? Displays Help for the command.
/set Adds a new entry to or updates an existing entry in the
resource system access control list for the resource type
specified.
/remove Removes all entries for the given user from the global
object access auditing list specified by the resource
type.
/clear Removes all entries from the global object access auditing
list for the specified resource type.
/view Lists the global object access auditing entries for the
specified resource type and user. Specifying a user is
optional.
Arguments
/type The resource for which object access auditing is being
configured. The supported argument values are File and
Key. Note that these values are case sensitive.
File: Directories and files.
Key: Registry keys.
/success Specifies success auditing.
/failure Specifies failure auditing.
/user Specifies a user in one of the following forms:
- DomainName\Account (such as DOM\Administrators)
- StandaloneServer\Group
- Account (see LookupAccountName API)
- {S-1-x-x-x-x}. x is expressed in decimal, and the entire
SID must be enclosed in curly braces.
For example: {S-1-5-21-5624481-130208933-164394174-1001}
Warning: If SID form is used, no check is done to verify
the existence of this account.
/access Specifies a permission mask that can be specified in one
of two forms:
- A sequence of simple rights:
Generic access rights:
GA - GENERIC ALL
GR - GENERIC READ
GW - GENERIC WRITE
GX - GENERIC EXECUTE
Access rights for files:
FA - FILE ALL ACCESS
FR - FILE GENERIC READ
FW - FILE GENERIC WRITE
FX - FILE GENERIC EXECUTE
Access rights for registry keys:
KA - KEY ALL ACCESS
KR - KEY READ
KW - KEY WRITE
KX - KEY EXECUTE
For example: '/access:FRFW' will enable audit events
for read and write operations.
- A hex value representing the access mask (such as
0x1200a9).
This is useful when using resource-specific bit masks
that are not part of the SDDL standard. If omitted,
Full access is used.
/condition Appends an attribute based expression like the following:
Document sensitivity is HBI ("High")
"(@Resource.Sensitivity == \"High\")"
Examples:
auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /success
auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success
/failure /access:FRFW
auditpol /resourceSACL /set /type:File /user:everyone /success
/failure /access:FRFW /condition:"(@Resource.Sensitivity == \"High\")"
auditpol /resourceSACL /type:File /clear
auditpol /resourceSACL /remove /type:File
/user:{S-1-5-21-56248481-1302087933-1644394174-1001}
auditpol /resourceSACL /type:File /view
auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuser
Usage: AuditPol /resourceSACL
[/set /type: [/success] [/failure] /user:
[/access:]]
[/remove /type: /user: [/type:]]
[/clear [/type:]]
[/view [/user:] [/type:]]
This command configures settings for global object access auditing. The
corresponding object access subcategory needs to be enabled for the events
to be generated by the system. Type auditpol /set /? for more information.
Commands
/? Displays Help for the command.
/set Adds a new entry to or updates an existing entry in the
resource system access control list for the resource type
specified.
/remove Removes all entries for the given user in the global
object access auditing list. If the type is not specified,
all entries for the user are removed.
/clear Removes all entries from the global object access auditing
list.
If the type is omitted, all entries are removed.
/view Lists the global object access auditing entries in a
resource system access control list, filtered by the given
user and resource type. The user and resource types are
optional.
Arguments
/type The resource for whom object access auditing is
being configured.
The supported values for resources are File and Key.
File: Directories and files.
Key: Registry keys.
/success Specifies success auditing.
/failure Specifies failure auditing.
/user Specifies a user in one of the following forms:
- DomainName\Account (such as DOM\Administrators)
- StandaloneServer\Group
- Account (see LookupAccountName API)
- {S-1-x-x-x-x}. x is expressed in decimal, and the entire
SID must be enclosed in curly braces.
For example: {S-1-5-21-5624481-130208933-164394174-1001}
Warning: If SID form is used, no check is done to verify
the existence of this account.
/access Specifies a permission mask that can be specified in one
of two forms:
- A sequence of simple rights:
Generic access rights:
GA - GENERIC ALL
GR - GENERIC READ
GW - GENERIC WRITE
GX - GENERIC EXECUTE
Access rights for files:
FA - FILE ALL ACCESS
FR - FILE GENERIC READ
FW - FILE GENERIC WRITE
FX - FILE GENERIC EXECUTE
Access rights for registry keys:
KA - KEY ALL ACCESS
KR - KEY READ
KW - KEY WRITE
KX - KEY EXECUTE
For example: '/access:FRFW' will enable audit events
for read and write operations.
- A hex value representing the access mask (such as
0x1200a9).
This is useful when using resource-specific bit masks
that are not part of the SDDL standard. If omitted,
Full access is used.
Examples:
auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /success
auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success
/failure /access:FRFW
auditpol /resourceSACL /type:File /clear
auditpol /resourceSACL /remove /type:File
/user:{S-1-5-21-56248481-1302087933-1644394174-1001}
auditpol /resourceSACL /type:File /view
auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuser