auditpol list
Lists audit policy categories and subcategories, or lists users for whom a per-user audit policy is defined. Windows commands reference
On Windows
Windows
Lists audit policy categories and subcategories, or lists users for whom a per-user audit policy is defined. To perform list operations on the per-user policy, you must have Read permission for that object set in the security descriptor. You can also perform list operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows additional access that is not necessary to perform the overall list operations.
auditpol /list[/user|/category|subcategory[:<categoryname>|<{guid}>|*]][/v] [/r]To list all users who have a defined audit policy, type
auditpol /list /userIdentify/listDisplays selectable policy elements. Windows commands reference/userRetrieves all users for whom the per-user audit policy has been defined. Windows commands referenceTo list all users who have a defined audit policy and their associated SID, type
auditpol /list /user /vIdentify/listDisplays selectable policy elements. Windows commands reference/userRetrieves all users for whom the per-user audit policy has been defined. Windows commands reference/vDisplays the GUID with the category or subcategory, or when used with /user, displays the SID of each user. Windows commands referenceTo list all categories and subcategories in report format, type
auditpol /list /subcategory:* /rIdentify/listDisplays selectable policy elements. Windows commands reference/subcategoryDisplays the names of subcategories and their associated GUID. Windows commands reference/rDisplays the output as a report in comma-separated value (CSV) format. Windows commands referenceTo list the subcategories of the detailed Tracking and DS Access categories, type
auditpol /list /subcategory:detailed Tracking,DS AccessIdentify/listDisplays selectable policy elements. Windows commands reference/subcategoryDisplays the names of subcategories and their associated GUID. Windows commands reference/userRetrieves all users for whom the per-user audit policy has been defined. If used with the /v parameter, the security identifier (SID) of the user is also displayed./categoryDisplays the names of categories understood by the system. If used with the /v parameter, the category globally unique identifier (GUID) is also displayed./subcategoryDisplays the names of subcategories and their associated GUID./vDisplays the GUID with the category or subcategory, or when used with /user, displays the SID of each user./rDisplays the output as a report in comma-separated value (CSV) format./?Displays help at the command prompt.