I have written a program that receives WMI events. Right now I have to manually go into the security settings in order to turn on the events of interest.
I can do this through the Windows GUI, but would like a way to do this programmatically.
I've looked at secedit
and auditpol
, but I can't seem to get their syntax correct. I either do not know which database to use, can't establish valid paths, or don't have the right permissions figured out.
I'd be happy with help in batch
, powershell
, or even C++
. How can I create a small script or app that sets the audit policies when ran?
Edit 8/3/16
Why can't a backup with auditpol
?
PS E:\agent\bin> auditpol /backup /file:backup.csv
Error 0x0000000D occurred:
The data is invalid.
PS E:\agent\bin> auditpol /backup /file:C\backup.csv
Failed to open file
Error 0x00000003 occurred:
The system cannot find the path specified.
PS E:\agent\bin> auditpol /backup /file:E\backup.csv
Failed to open file
Error 0x00000003 occurred:
The system cannot find the path specified.
User contributions licensed under CC BY-SA 3.0