{
	"id": "713cebdf-e85f-4240-b28c-7bdd1873365e",
	"created_at": "2026-04-06T00:19:06.358809Z",
	"updated_at": "2026-04-10T03:20:35.099417Z",
	"deleted_at": null,
	"sha1_hash": "0f7e220f70ccc948bbcfcd1be6cbaaad86613a89",
	"title": "auditpol",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 40465,
	"plain_text": "auditpol\r\nBy robinharwood\r\nArchived: 2026-04-05 18:57:50 UTC\r\nDisplays information about and performs functions to manipulate audit policies, including:\r\nSetting and querying a system audit policy.\r\nSetting and querying a per-user audit policy.\r\nSetting and querying auditing options.\r\nSetting and querying the security descriptor used to delegate access to an audit policy.\r\nReporting or backing up an audit policy to a comma-separated value (CSV) text file.\r\nLoading an audit policy from a CSV text file.\r\nConfiguring global resource SACLs.\r\nSyntax\r\nauditpol command [\u003csub-command\u003e\u003coptions\u003e]\r\nParameters\r\nSub-command\r\nDescription\r\n/get\r\nDisplays the current audit policy. For more information, see auditpol get for syntax and\r\noptions.\r\n/set Sets the audit policy. For more information, see auditpol set for syntax and options.\r\n/list\r\nDisplays selectable policy elements. For more information, see auditpol list for syntax and\r\noptions.\r\n/backup\r\nSaves the audit policy to a file. For more information, see auditpol backup for syntax and\r\noptions.\r\n/restore\r\nRestores the audit policy from a file that was previously created by using auditpol /backup.\r\nFor more information, see auditpol restore for syntax and options.\r\n/clear Clears the audit policy. For more information, see auditpol clear for syntax and options.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol\r\nPage 1 of 2\n\nSub-command\r\nDescription\r\n/remove\r\nRemoves all per-user audit policy settings and disables all system audit policy settings. For\r\nmore information, see auditpol remove for syntax and options.\r\n/resourceSACL\r\nConfigures global resource system access control lists (SACLs). Note: Applies only to\r\nWindows 7 and Windows Server 2008 R2. For more information, see auditpol\r\nresourceSACL.\r\n/? Displays help at the command prompt.\r\nRelated links\r\nCommand-Line Syntax Key\r\nSource: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol"
	],
	"report_names": [
		"auditpol"
	],
	"threat_actors": [],
	"ts_created_at": 1775434746,
	"ts_updated_at": 1775791235,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0f7e220f70ccc948bbcfcd1be6cbaaad86613a89.pdf",
		"text": "https://archive.orkl.eu/0f7e220f70ccc948bbcfcd1be6cbaaad86613a89.txt",
		"img": "https://archive.orkl.eu/0f7e220f70ccc948bbcfcd1be6cbaaad86613a89.jpg"
	}
}