auditpol remove
The auditpol remove command removes the per-user audit policy for a specified account or all accounts. Windows commands reference
On Windows
Windows
The auditpol remove command removes the per-user audit policy for a specified account or all accounts. To perform remove operations on the per-user policy, you must have Write or Full Control permissions for that object set in the security descriptor. You can also perform remove operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows access that isn't necessary to perform the overall remove operations.
auditpol /remove [/user[:<username>|<{SID}>]][/allusers]To remove the per-user audit policy for user mikedan by name, type
auditpol /remove /user:mikedanIdentify/removeRemoves all per-user audit policy settings and disables all system audit policy settings. Windows commands reference/userSpecifies the security identifier (SID) or user name for the user for whom the per-user audit policy is to be deleted. Windows commands referenceTrips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
To remove the per-user audit policy for user mikedan by SID, type
auditpol /remove /user:{S-1-5-21-397123471-12346959}Identify/removeRemoves all per-user audit policy settings and disables all system audit policy settings. Windows commands reference/userSpecifies the security identifier (SID) or user name for the user for whom the per-user audit policy is to be deleted. Windows commands referenceTrips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
To remove the per-user audit policy for all users, type
auditpol /remove /allusersIdentify/removeRemoves all per-user audit policy settings and disables all system audit policy settings. Windows commands reference/allusersRemoves the per-user audit policy for all users. Windows commands referenceTrips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
/userSpecifies the security identifier (SID) or user name for the user for whom the per-user audit policy is to be deleted./allusersRemoves the per-user audit policy for all users./?Displays help at the command prompt.