Edit

auditpol set

  • Article

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Sets the per-user audit policy, system audit policy, or auditing options.

To perform set operations on the per-user and system policies, you must have Write or Full Control permission for that object set in the security descriptor. You can also perform set operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows additional access that is not necessary to perform the overall set operations.

Syntax

auditpol /set
[/user[:<username>|<{sid}>][/include][/exclude]]
[/category:<name>|<{guid}>[,:<name|<{guid}> ]]
[/success:<enable>|<disable>][/failure:<enable>|<disable>]
[/subcategory:<name>|<{guid}>[,:<name|<{guid}> ]]
[/success:<enable>|<disable>][/failure:<enable>|<disable>]
[/option:<option name> /value: <enable>|<disable>]

Parameters

Parameter Description
/user The security principal for whom the per-user audit policy specified by the category or subcategory is set. Either the category or subcategory option must be specified, as a security identifier (SID) or name.
/include Specified with /user; indicates that the user's per-user policy will cause an audit to be generated even if it is not specified by the system audit policy. This setting is the default and is automatically applied if neither the /include nor /exclude parameters are explicitly specified.
/exclude Specified with /user; indicates that the user's per-user policy will cause an audit to be suppressed regardless of the system audit policy. This setting is ignored for users who are members of the local Administrators group.
/category One or more audit categories specified by globally unique identifier (GUID) or name. If no user is specified, the system policy is set.
/subcategory One or more audit subcategories specified by GUID or name. If no user is specified, the system policy is set.
/success Specifies success auditing. This setting is the default and is automatically applied if neither the /success nor /failure parameters are explicitly specified. This setting must be used with a parameter indicating whether to enable or disable the setting.
/failure Specifies failure auditing. This setting must be used with a parameter indicating whether to enable or disable the setting.
/option Sets the audit policy for the CrashOnAuditFail, FullprivilegeAuditing, AuditBaseObjects, or AuditBasedirectories options.
/sd Sets the security descriptor used to delegate access to the audit policy. The security descriptor must be specified by using the Security Descriptor Definition Language (SDDL). The security descriptor must have a discretionary access control list (DACL).
/? Displays help at the command prompt.

Examples

To set the per-user audit policy for all subcategories under the detailed Tracking category for the user mikedan so that all the user's successful attempts will be audited, type:

auditpol /set /user:mikedan /category:detailed Tracking /include /success:enable

To set the per-user audit policy for categories specified by name and GUID, and subcategories specified by GUID to suppress auditing for any successful or failed attempts, type:

auditpol /set /user:mikedan /exclude /category:Object Access,System,{6997984b-797a-11d9-bed3-505054503030}
/subcategory:{0ccee9210-69ae-11d9-bed3-505054503030},:{0ccee9211-69ae-11d9-bed3-505054503030}, /success:enable /failure:enable

To set the per-user audit policy for the specified user for all the categories for the suppression of auditing of all but successful attempts, type:

auditpol /set /user:mikedan /exclude /category:* /success:enable

To set the system audit policy for all subcategories under the detailed Tracking category to include auditing for only successful attempts, type:

auditpol /set /category:detailed Tracking /success:enable

Note

The failure setting is not altered.

To set the system audit policy for the Object Access and System categories (which is implied because subcategories are listed) and subcategories specified by GUIDs for the suppression of failed attempts and the auditing of successful attempts, type:

auditpol /set /subcategory:{0ccee9210-69ae-11d9-bed3-505054503030},{0ccee9211-69ae-11d9-bed3-505054503030}, /failure:disable /success:enable

To set the auditing options to the enabled state for the CrashOnAuditFail option, type:

auditpol /set /option:CrashOnAuditFail /value:enable