auditpol resourcesacl
Configures global resource system access control lists (SACLs). Windows commands reference
On Windows
Windows
Configures global resource system access control lists (SACLs). To perform resourceSACL operations, you must have Write or Full Control permissions for that object set in the security descriptor. You can also perform resourceSACL operations if you have the Manage auditing and security log (SeSecurityPrivilege) user right.
auditpol /resourceSACL[/set /type:<resource> [/success] [/failure] /user:<user> [/access:<access flags>]][/remove /type:<resource> /user:<user> [/type:<resource>]][/clear [/type:<resource>]][/view [/user:<user>] [/type:<resource>]]To set a global resource SACL to audit successful access attempts by a user on a registry key
auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /successIdentify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/setAdds a new entry to or updates an existing entry in the resource SACL for the resource type specified. Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/userSpecifies a user in one of the following forms: DomainName\Account (such as DOM\Administrators) StandaloneServer\Group Account (see LookupAccountName function) {S-1-x-x-x-x} (x is expressed in decimal, and the entire SI… Windows commands reference/successSpecifies success auditing. Windows commands referenceTo set a global resource SACL to audit successful and failed attempts by a user to perform generic read and write functions on files or folders
auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success /failure /access:FRFWIdentify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/setAdds a new entry to or updates an existing entry in the resource SACL for the resource type specified. Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/userSpecifies a user in one of the following forms: DomainName\Account (such as DOM\Administrators) StandaloneServer\Group Account (see LookupAccountName function) {S-1-x-x-x-x} (x is expressed in decimal, and the entire SI… Windows commands reference/successSpecifies success auditing. Windows commands reference/failureSpecifies failure auditing. Windows commands reference/accessSpecifies a permission mask that can be specified through: Generic access rights, including: GA - GENERIC ALL GR - GENERIC READ GW - GENERIC WRITE GX - GENERIC EXECUTE Access rights for files, including: FA - FILE ALL A… Windows commands referenceTo remove all global resource SACL entries for files or folders
auditpol /resourceSACL /type:File /clearIdentify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/clearRemoves all entries from the global object access auditing list. Windows commands referenceTrips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
To remove all global resource SACL entries for a particular user from files or folders
auditpol /resourceSACL /remove /type:File /user:{S-1-5-21-56248481-1302087933-1644394174-1001}Identify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/removeRemoves all entries for the given user in the global object access auditing list. Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/userSpecifies a user in one of the following forms: DomainName\Account (such as DOM\Administrators) StandaloneServer\Group Account (see LookupAccountName function) {S-1-x-x-x-x} (x is expressed in decimal, and the entire SI… Windows commands referenceTrips 1 Sigma rule: highAudit Policy Tampering Via Auditpol by Janantha Marasinghe (https://github.com/blueteam0ps)
To list the global object access auditing entries set on files or folders
auditpol /resourceSACL /type:File /viewIdentify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/viewLists the global object access auditing entries in a resource SACL. Windows commands referenceTo list the global object access auditing entries for a particular user that are set on files or folders
auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuserIdentify/resourceSACLConfigures global resource system access control lists (SACLs). Windows commands reference/typeThe resource for which object access auditing is being configured. Windows commands reference/viewLists the global object access auditing entries in a resource SACL. Windows commands reference/userSpecifies a user in one of the following forms: DomainName\Account (such as DOM\Administrators) StandaloneServer\Group Account (see LookupAccountName function) {S-1-x-x-x-x} (x is expressed in decimal, and the entire SI… Windows commands reference/setAdds a new entry to or updates an existing entry in the resource SACL for the resource type specified./removeRemoves all entries for the given user in the global object access auditing list./clearRemoves all entries from the global object access auditing list./viewLists the global object access auditing entries in a resource SACL. The user and resource types are optional./?Displays help at the command prompt./typeThe resource for which object access auditing is being configured. The supported, case-sensitive, argument values are File (for directories and files) and Key (for registry keys)./successSpecifies success auditing./failureSpecifies failure auditing./userSpecifies a user in one of the following forms:
- DomainName\Account (such as DOM\Administrators)
- StandaloneServer\Group Account (see LookupAccountName function)
- {S-1-x-x-x-x} (x is expressed in decimal, and the entire SID must be enclosed in curly braces). For example: {S-1-5-21-5624481-130208933-164394174-1001}
Note: If the SID form is used, no check is done to verify the existence of this account./accessSpecifies a permission mask that can be specified through:
Generic access rights, including:
- GA - GENERIC ALL
- GR - GENERIC READ
- GW - GENERIC WRITE
- GX - GENERIC EXECUTE
Access rights for files, including:
- FA - FILE ALL ACCESS
- FR - FILE GENERIC READ
- FW - FILE GENERIC WRITE
- FX - FILE GENERIC EXECUTE
Access rights for registry keys, including:
- KA - KEY ALL ACCESS
- KR - KEY READ
- KW - KEY WRITE
- KX - KEY EXECUTE
For example: /access:FRFW enables audit events for read and write operations.
A hexadecimal value representing the access mask (such as 0x1200a9)
This is useful when using resource-specific bit masks that are not part of the security descriptor definition language (SDDL) standard. If omitted, Full access is used.