This pattern is useful when audit policy changes need a rollback point.

It is adapted from Examples/BackupAuditPolicies.ps1 and Examples/RestoreAuditPolicies.ps1.

Example

Import-Module AuditPolicy

$backupPath = Join-Path $PSScriptRoot 'Backups\AuditPolicy.json'
New-Item -ItemType Directory -Path (Split-Path $backupPath) -Force | Out-Null

Backup-SystemAuditPolicy | Out-File -FilePath $backupPath

Restore-SystemAuditPolicy -FilePath $backupPath -Verbose -WhatIf
Restore-SystemAuditPolicy -FilePath $backupPath -Policy 'Application Group Management' -Verbose -WhatIf

What this demonstrates

• keeping a policy backup near the script
• testing restore behavior before applying it
• restoring a complete policy file or a selected policy

Source

• BackupAuditPolicies.ps1
• RestoreAuditPolicies.ps1