Home / server / Questions / 968733
In Process
Joe
Asked: 2019-05-25 07:07:33 +0800 CST

Command to Get Security Audit settings

  • 772

Im looking to retrieve the Security audit configuration on a domain joined PC which has audit settings applied Via a domain GPO, but im getting - what seems to be - conflicting results. If i run an RSOP, i see the aduting settings, but Auditpol /get /category:"Logon/Logoff" shows No Auditing. Likewise the local security policy UI, or an secedit export all show No Auditing (AuditLogonEvents = 0). See screenshot below. I know there's a legacy and advanced version of auditing which could be determined by the SCENoApplyLegacyAuditPolicy reg key under HKLM\System\CurrentControlSet\Control\LSA but i dont see the key at all on this machine in question. How could i accurately fetch the auditing settings under any scenario?

enter image description here

enter image description here

windows

1 Answers

  1. Auditpol is for Advanced Audit Policy settings.

    The policy settings configured in the screenshot are legacy audit policy settings. To view those use: 

    secedit /export /areas SECURITYPOLICY /cfg Filename.txt

    Advanced Audit Policy Configuration

    • 0