auditpol
By robinharwood
Archived: 2026-04-05 18:57:50 UTC
Displays information about and performs functions to manipulate audit policies, including:
Setting and querying a system audit policy.
Setting and querying a per-user audit policy.
Setting and querying auditing options.
Setting and querying the security descriptor used to delegate access to an audit policy.
Reporting or backing up an audit policy to a comma-separated value (CSV) text file.
Loading an audit policy from a CSV text file.
Configuring global resource SACLs.
Syntax
auditpol command [<sub-command><options>]
Parameters
Sub-command
Description
/get
Displays the current audit policy. For more information, see auditpol get for syntax and
options.
/set Sets the audit policy. For more information, see auditpol set for syntax and options.
/list
Displays selectable policy elements. For more information, see auditpol list for syntax and
options.
/backup
Saves the audit policy to a file. For more information, see auditpol backup for syntax and
options.
/restore
Restores the audit policy from a file that was previously created by using auditpol /backup.
For more information, see auditpol restore for syntax and options.
/clear Clears the audit policy. For more information, see auditpol clear for syntax and options.
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
Page 1 of 2

Sub-command
Description
/remove
Removes all per-user audit policy settings and disables all system audit policy settings. For
more information, see auditpol remove for syntax and options.
/resourceSACL
Configures global resource system access control lists (SACLs). Note: Applies only to
Windows 7 and Windows Server 2008 R2. For more information, see auditpol
resourceSACL.
/? Displays help at the command prompt.
Related links
Command-Line Syntax Key
Source: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
Page 2 of 2