auditpol
Displays information about and performs functions to manipulate audit policies, including: Windows commands reference
On Windows 1 Sigma rule name it 8 sub-commands File auditpol.exe
Windows
Displays information about and performs functions to manipulate audit policies, including: - Setting and querying a system audit policy. - Setting and querying a per-user audit policy. - Setting and querying auditing options. - Setting and querying the security descriptor used to delegate access to an audit policy. - Reporting or backing up an audit policy to a comma-separated value (CSV) text file. - Loading an audit policy from a CSV text file. - Configuring global resource SACLs.
auditpol command [<options>]/getDisplays the current audit policy. For more information, see auditpol get for syntax and options./setSets the audit policy. For more information, see auditpol set for syntax and options./listDisplays selectable policy elements. For more information, see auditpol list for syntax and options./backupSaves the audit policy to a file. For more information, see auditpol backup for syntax and options./restoreRestores the audit policy from a file that was previously created by using auditpol /backup. For more information, see auditpol restore for syntax and options./clearClears the audit policy. For more information, see auditpol clear for syntax and options./removeRemoves all per-user audit policy settings and disables all system audit policy settings. For more information, see auditpol remove for syntax and options./resourceSACLConfigures global resource system access control lists (SACLs). Note: Applies only to Windows 7 and Windows Server 2008 R2. For more information, see auditpol resourceSACL./?Displays help at the command prompt.