auditpol clear
Deletes the per-user audit policy for all users, resets (disables) the system audit policy for all subcategories, and sets all the auditing options to disabled.
To perform clear operations on the per-user and system policies, you must have Write or Full Control permission for that object set in the security descriptor. You can also perform clear operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows additional access that is not necessary to perform the overall clear operations.
Syntax
auditpol /clear [/y]
Parameters
| Parameter | Description |
|---|---|
| /y | Suppresses the prompt to confirm if all audit policy settings should be cleared. |
| /? | Displays help at the command prompt. |
Examples
To delete the per-user audit policy for all users, reset (disable) the system audit policy for all subcategories, and set all the audit policy settings to disabled, at a confirmation prompt, type:
auditpol /clear
To delete the per-user audit policy for all users, reset the system audit policy settings for all subcategories, and set all the audit policy settings to disabled, without a confirmation prompt, type:
auditpol /clear /y
Note
The preceding example is useful when using a script to perform this operation.