This module was tested using Windows PowerShell 5.1 on:

• Windows 11
• Windows 2016
• Windows 2012 R2

It should work correctly on Windows 2019, Windows 2022, and Windows 10. I belive it should work on Windows 2012 and earlier (assuming Windows PowerShell 5.1 will work) but that requires confirmation. Registry values are different and I've not tested in on those systems. As it's already not supported by Microsoft there's no need to investigate this.

There are three ways one can deal with setting up Auditing Policies in Windows systems. Those are:

• Group Policies (GPO)
• Local Group Policy Objects (using secpol.msc)
• Using AuditPol.exe

It's essential to understand the consequences of using all three methods. As Microsoft describes it in AuditPol and Local Security Policy, results may troubleshoot guide:

AuditPol directly calls authorization APIs to implement the changes to the granular audit policy. Secpol.msc manipulates the Local Group Policy Object, which results in writing the changes to %SYSTEMROOT%\system32\GroupPolicy\Machine\Microsoft\Windows NT\Audit\Audit.csv.

The settings saved to the .csv file aren't applied directly to the system at the time of modification but are instead written to the file and read later by the client-side extension (CSE). At the next group policy refresh cycle, the CSE applies the modifications that are present in the .csv file.

It took me a while to understand what was happening and question the method I was using to set Auditing settings. Why is this important? Because if audit.csv exists with some settings that you do via Local Group Policy, whatever you set via auditpol.exe or my PowerShell Module will get scrapped.

Secpol.msc displays what is set in the local GPO. There's no "effective settings" view in secpol.msc that will merge granular AuditPol settings and what is defined locally as seen with secpol.msc.

Install-Module -Name AuditPolicy -AllowClobber -Force

Force and AllowClobber aren't necessary but they do skip errors in case some appear.

Update-Module -Name AuditPolicy

That's it. Whenever there's a new version you simply run the command and you can enjoy it. Remember, that you may need to close, reopen the PowerShell session if you have already used the module before updating it.

The important thing is if something works for you on production, keep using it till you test the new version on a test computer. I do changes that may not be big, but big enough that auto-update will break your code. For example, small rename to a parameter and your code stops working! Be responsible!

Getting system audit policies

$AuditPolicies = Get-SystemAuditPolicy
$AuditPolicies | Format-Table

Getting system audit policies but split by category

$AuditPolicies = Get-SystemAuditPolicy -Categories
$AuditPolicies | Format-Table

Getting single system audit policy

Get-SystemAuditPolicy -Policy 'Application Group Management'

AuditPolicy has 3 ways to modify System Audit Policies. One of the ways is doing it via Local Security Policy. By using UseLocalSecurityPolicy switch we force AuditPolicy to use Local Security Policy.

Set-SystemAuditPolicy -Policy 'Account Lockout' -Value SuccessAndFailure -UseLocalSecurityPolicy -WhatIf
Set-SystemAuditPolicy -Policy 'Group Membership' -Value Failure -UseLocalSecurityPolicy -WhatIf

Please keep in mind that setting AuditPolicy via Local Security Policy has no immediate impact and requires GPO refresh (can be forced with gpupdate /force)

Another option is to use auditpol.exe. In case UseAuditPol switch is used AuditPolicy will use auditpol.exe to set the Audit Policies.

Set-SystemAuditPolicy -System 'Security State Change' -Value SuccessAndFailure -WhatIf:$WhatIf -UseAuditPol

Finally, the default option is to use the registry, which sets proper binary value with set options

$WhatIf = $false
Set-SystemAuditPolicy -System 'Security State Change' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountLogon 'Other Account Logon Events' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountLogon 'Kerberos Authentication Service' -Value SuccessAndFailure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountLogon 'Credential Validation' -Value Success -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'Computer Account Management' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'Application Group Management' -Value Success -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'Distribution Group Management' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'Other Account Management Events' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'Security Group Management' -Value Failure -Verbose -WhatIf:$WhatIf
Set-SystemAuditPolicy -AccountManagement 'User Account Management' -Value Failure -Verbose -WhatIf:$WhatIf

Sometimes before doing anything you may want to backup your policies

Backup-SystemAuditPolicy | Out-File -FilePath $PSScriptRoot\Backups\AuditPolicy.json

To restore

$FilePath = "$PSScriptRoot\Backups\AuditPolicy.json"

Restore-SystemAuditPolicy -FilePath $FilePath -Verbose -WhatIf
Restore-SystemAuditPolicy -FilePath $FilePath -Verbose -Policy 'Application Group Management' -WhatIf

Subcategories used within Audit.csv file to manage