How to set Windows audit policies programmatically?

2

I have written a program that receives WMI events. Right now I have to manually go into the security settings in order to turn on the events of interest.

Local Security Policy

I can do this through the Windows GUI, but would like a way to do this programmatically.

I've looked at secedit and auditpol, but I can't seem to get their syntax correct. I either do not know which database to use, can't establish valid paths, or don't have the right permissions figured out.

I'd be happy with help in batch, powershell, or even C++. How can I create a small script or app that sets the audit policies when ran?

Edit 8/3/16

Why can't a backup with auditpol?

PS E:\agent\bin> auditpol /backup /file:backup.csv
Error 0x0000000D occurred:
The data is invalid.

PS E:\agent\bin> auditpol /backup /file:C\backup.csv
Failed to open file
Error 0x00000003 occurred:
The system cannot find the path specified.

PS E:\agent\bin> auditpol /backup /file:E\backup.csv
Failed to open file
Error 0x00000003 occurred:
The system cannot find the path specified.
windows
powershell
batch-file
audit
local-security-policy
asked on Stack Overflow Aug 1, 2016 by Coop • edited Aug 3, 2016 by Coop

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0