auditpol
Displays information about and performs functions to manipulate audit policies, including:
Setting and querying a system audit policy.
Setting and querying a per-user audit policy.
Setting and querying auditing options.
Setting and querying the security descriptor used to delegate access to an audit policy.
Reporting or backing up an audit policy to a comma-separated value (CSV) text file.
Loading an audit policy from a CSV text file.
Configuring global resource SACLs.
Syntax
auditpol command [<sub-command><options>]
Parameters
| Sub-command | Description |
|---|---|
| /get | Displays the current audit policy. For more information, see auditpol get for syntax and options. |
| /set | Sets the audit policy. For more information, see auditpol set for syntax and options. |
| /list | Displays selectable policy elements. For more information, see auditpol list for syntax and options. |
| /backup | Saves the audit policy to a file. For more information, see auditpol backup for syntax and options. |
| /restore | Restores the audit policy from a file that was previously created by using auditpol /backup. For more information, see auditpol restore for syntax and options. |
| /clear | Clears the audit policy. For more information, see auditpol clear for syntax and options. |
| /remove | Removes all per-user audit policy settings and disables all system audit policy settings. For more information, see auditpol remove for syntax and options. |
| /resourceSACL | Configures global resource system access control lists (SACLs). Note: Applies only to Windows 7 and Windows Server 2008 R2. For more information, see auditpol resourceSACL. |
| /? | Displays help at the command prompt. |