Audit Policies
Enumerate
auditpol /get /category:*
Current audit policy settings for all categories.
auditpol /get /User:UserName / Category:*
Current audit policy settings for user, all audit categories.
auditpol /List /User /V
All user-level audit policy settings.
auditpol (auditpol /get /category:*)
Check policies <auditusr on xp/2003>
Get-AuditPolicy
Gets the audit policy for one or more audit subcategories.
wevtutil gp Microsoft-Windows-Security-Auditing /ge:true
Gets the audit policy settings for the Security log using wevtutil.
secedit /export /cfg C:\auditpolicy.txt
Exports the security settings, including audit policies, to a text file.
Get-GPOReport -All -ReportType Xml -Path C:\GPOAuditReport.xml
Generates a report of all Group Policy Objects, including audit policy settings, in XML.
gpresult /H C:\GPOReport.html /SCOPE COMPUTER
Generates an HTML report that includes the results of Group Policy application, which covers audit policies for the computer.
Shows the logging settings for the current firewall profile, which can indirectly relate to auditing network activities:
Filters the Security event log for events with ID 4719, which indicate changes to audit policy settings.
Retrieves the 50 most recent security events with Event ID 4719, indicating changes to audit policies.
Modify
Disables auditing for all subcategories under Logon/Logoff:
Enables both success and failure auditing for the Logon events:
Deletes (resets) audit policy settings for all subcategories to default values.
Uses PowerShell to enable success auditing and disable failure auditing for Account Management.
Sets success and failure auditing for the Logon subcategory using PowerShell:
Enables auditing for all subcategories for both success and failure events using PowerShell:
Backs up the current audit policy settings to a file.
Restores audit policy settings from a backup file.
Audit Policy Categories and Sub-Categories
The audit categories and subcategories in Windows are part of the Advanced Audit Policy Configuration, which allows administrators to get more granular with their audit policies.
Here's a summary of the main categories and some of their subcategories as of my last update:
Account Logon
Credential Validation
Kerberos Service Ticket Operations
Kerberos Authentication Service
Other Account Logon Events
Account Management
Computer Account Management
Security Group Management
Distribution Group Management
Application Group Management
Other Account Management Events
User Account Management
Detailed Tracking
DPAPI Activity
Process Creation
Process Termination
RPC Events
DS Access
Directory Service Access
Directory Service Changes
Directory Service Replication
Detailed Directory Service Replication
Logon/Logoff
Account Lockout
IPsec Main Mode
IPsec Quick Mode
IPsec Extended Mode
Special Logon
Logoff
Logon
Network Policy Server
Other Logon/Logoff Events
User / Device Claims
Object Access
Application Generated
Certification Services
Detailed File Share
File Share
File System
Filtering Platform Connection
Filtering Platform Packet Drop
Handle Manipulation
Kernel Object
Other Object Access Events
Registry
SAM
Policy Change
Audit Policy Change
Authentication Policy Change
Authorization Policy Change
MPSSVC Rule-Level Policy Change
Filtering Platform Policy Change
Other Policy Change Events
Privilege Use
Non-Sensitive Privilege Use
Other Privilege Use Events
Sensitive Privilege Use
System
IPsec Driver
Other System Events
Security State Change
Security System Extension
System Integrity
Global Object Access Auditing
File System
Registry
Each category and subcategory provides specific events that can be audited to give administrators insight into the security and operations of a Windows environment.
The availability of certain categories and subcategories can depend on the version of Windows you are using.
Last updated
Was this helpful?