Example from the linked Microsoft Learn article. Check its paths, targets and availability before adapting it.
auditpol /get /category:Systemauditpol get command
This guide gathers the Microsoft Learn syntax and parameter reference for auditpol get, a Windows command or tool subcommand. Availability can depend on Windows version, role, optional feature and execution context.
Documented syntax
auditpol /getThe linked Microsoft Learn article is the upstream authority. Availability may depend on Windows release, role, optional feature or interactive tool context.
Examples
Example from the linked Microsoft Learn article. Check its paths, targets and availability before adapting it.
auditpol /get /user:guest /category:System /subcategory:{0ccee921a-69ae-11d9-bed3-505054503030}Example from the linked Microsoft Learn article. Check its paths, targets and availability before adapting it.
auditpol /get /option:AuditBaseObjects /rParameters, options and clauses
| Option / clause | Description |
|---|---|
/user[:<username>|<{sid}>] | Query the per-user policy for a user name or SID; without a user, query the system policy. |
/category:*|<name>|<{guid}> | Select one or more audit categories by name or GUID; * selects all. |
/subcategory:*|<name>|<{guid}> | Select one or more audit subcategories by name or GUID. |
/option:<option name> | Query an audit option such as CrashOnAuditFail or AuditBaseObjects. |
/sd | Retrieve the security descriptor controlling delegated access to audit policy. |
/r | Format the output as comma-separated values (CSV). |
/? | Display command help. |
/get | Retrieve the current system policy, per-user policy, audit options or policy security descriptor. |
Review a command and its target before running it. Commands that alter files, services, accounts, disks, permissions or databases may be difficult to reverse. Test in a safe environment and keep backups.