I want to edit the local security audit policy from the command line. From what I found out, there's auditpol.exe
and I can set the policy using the "/set" parameter. This does indeed work, but there's one problem:
I need specify the category and subcategory by a string that is in the systems language. For example, my windows is set to german, therefore the command looks like this:
auditpol.exe /set /category:"detaillierte Nachverfolgung" /subcategory:"Prozesserstellung" /success:enable
"detaillierte Nachverfolgung" = detailed Tracking
"Prozesserstellung" = Process creation
When ever I try to use the english names, I get the error 0x00000057 (wrong parameter).
This is copyied from the official documentation from Microsoft:
Auditpol /set /category:"Detailed Tracking" /success:enable
If i execute this, I get the error mentioned above.
I need to be able to set the policy regardless of the users system language.
Is there any way to do so?
You have to use the guid, this is language agnostic. Example for account login and logon/logoff:
auditpol /set /category:"{69979849-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
auditpol /set /category:"{69979850-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
Get the list of guids by doing this:
auditpol /list /subcategory:* /r
User contributions licensed under CC BY-SA 3.0