Windows 11 includes an authoritative command-line security tool known as auditpol that enables system administrators and security professionals to configure and inspect granular subcategory audit policies. While standard Group Policy settings often apply broad categories, auditpol provides direct, granular control over specific telemetry events such as Process Creation, Credential Validation, and User Rights Assignment without requiring a system restart.
Why Use auditpol Instead of Basic Group Policy?
Traditional Windows audit policies only offered nine high-level categories (such as Logon Events or Object Access). Modern Windows operating systems expand these into more than fifty specialised subcategories. Configuring auditing via auditpol ensures you only log critical security events, preventing the Windows Security Event Log from being overwhelmed by benign noise while maintaining compliance and threat-hunting visibility.
Syntax and Key Parameters
auditpol /get | /set | /list | /backup | /restore [options]/get: Displays the current audit policy for categories, subcategories, or specific user accounts./set: Configures the audit policy for a specified category or subcategory./list: Enumerates available policy categories and subcategories./backup: Exports the entire current security audit policy to a CSV file./restore: Imports and restores an audit policy from a previously exported CSV file./clear: Resets all subcategory audit policies to system defaults.
Step-by-Step Practical Implementation
Step 1: Open an Elevated Command Prompt
- Press Windows Key + S and type
cmd. - Right-click Command Prompt and select Run as administrator.
- Click Yes when prompted by User Account Control (UAC).
Step 2: List All Available Categories and Subcategories
To inspect the available auditing hierarchy, run:
auditpol /list /subcategory:*This displays all categories, including Detailed Tracking, Account Logon, Object Access, and Privilege Use, alongside their corresponding subcategories.
Step 3: Query Current Auditing Settings
To view your active configuration across all security subcategories, execute:
auditpol /get /category:*Each entry displays its status: Success, Failure, Success and Failure, or No Auditing.
Step 4: Enable Detailed Process Creation Auditing
Tracking executable process launches is essential for malware detection and incident response. To enable both success and failure logging for Process Creation, enter:
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enableThe command returns: The command was successfully executed.
Step 5: Back Up the Security Audit Policy
Before applying major configuration changes across enterprise endpoints, export a baseline backup to a secure directory:
auditpol /backup /file:"C:\SecurityBaselines\AuditPolicy_Backup.csv"auditpol Subcategory Operational Reference
| Subcategory Name | Parent Category | Target Event IDs | Recommended Policy | Security Benefit |
|---|---|---|---|---|
| Process Creation | Detailed Tracking | 4688 | Success | Captures process executions and parent-child telemetry |
| Credential Validation | Account Logon | 4776 | Success & Failure | Detects brute-force authentication and NTLM exploitation |
| Sensitive Privilege Use | Privilege Use | 4672, 4673 | Success & Failure | Alerts on administrative token elevation and debug rights |
| Security System Extension | System | 4610, 4611 | Success | Monitors authentication packages and kernel driver loads |
| Audit Policy Change | Policy Change | 4719 | Success & Failure | Detects unauthorized tampering with security audit rules |
Best Practices and Operational Notes
- Group Policy Precedence: If domain-level Group Policy Objects (GPOs) configure auditing subcategories, they will overwrite local
auditpolconfigurations during standard GPO refresh intervals (every 90 minutes by default). - Include Command Line in Event 4688: To maximise the value of Process Creation auditing, enable “Include command line in process creation events” under Administrative Templates in Local Group Policy Editor.
- Event Log Capacity: Enabling extensive success auditing across Object Access significantly increases log volume. Ensure your Security Event Log size is increased from the default 20 MB to at least 1024 MB.