CmdID

CmdID / Commands / auditpol

auditpol clear

Deletes the per-user audit policy for all users, resets (disables) the system audit policy for all subcategories, and sets all the auditing options to disabled. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Deletes the per-user audit policy for all users, resets (disables) the system audit policy for all subcategories, and sets all the auditing options to disabled. To perform clear operations on the per-user and system policies, you must have Write or Full Control permission for that object set in the security descriptor. You can also perform clear operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows additional access that is not necessary to perform the overall clear operations.

auditpol /clear [/y]

To delete the per-user audit policy for all users, reset (disable) the system audit policy for all subcategories, and set all the audit policy settings to disabled, at a confirmation prompt, type

auditpol /clearIdentify
/clearClears the audit policy. Windows commands reference

Trips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)

To delete the per-user audit policy for all users, reset the system audit policy settings for all subcategories, and set all the audit policy settings to disabled, without a confirmation prompt, type

auditpol /clear /yIdentify
/clearClears the audit policy. Windows commands reference
/ySuppresses the prompt to confirm if all audit policy settings should be cleared. Windows commands reference

Trips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)

/ySuppresses the prompt to confirm if all audit policy settings should be cleared.
/?Displays help at the command prompt.