How to Use the auditpol Command in Windows 11 to Configure Advanced Security Audit Policies

In enterprise cybersecurity engineering, threat detection, and regulatory compliance, the Windows Security Event Log provides the foundational forensic audit trail. However, Windows 11 defaults to minimal security event logging, capturing basic account events while omitting critical telemetry such as process creation command-line arguments, privilege escalations, and sensitive file modifications. While the graphical Local Security Policy editor (secpol.msc) allows configuration, enterprise administrators and automated hardening scripts rely on the native auditpol.exe command-line utility. Mastering auditpol enables security teams to granularly query, configure, export, and restore the 53 subcategories of Advanced Security Audit Policies without causing event log bloat.

Advanced Audit Policy Hierarchy vs. Basic Audit Policies

Windows operating systems historically offered nine “basic” audit categories. Modern Windows 11 architecture expands these into 53 discrete subcategories, granting precision control over what activities trigger audit records in the Security Event Log. The table below delineates the primary categories and key subcategories:

Main Audit Category	Key Subcategories	Critical Event IDs Generated	Forensic Value
Account Logon	Kerberos Authentication Service, Kerberos Ticket Operations, Credential Validation.	4768, 4769, 4771, 4776	Detects Golden Ticket attacks, Kerberoasting, and brute-force password spraying.
Detailed Tracking	Process Creation, Process Termination, RPC Events.	4688, 4689	Records every executed binary, parent process ID, and full command-line arguments.
Logon/Logoff	Logon, Logoff, Special Logon, Account Lockout.	4624, 4625, 4634, 4672	Identifies failed logon attempts (Type 3 network, Type 10 RDP) and administrative privilege use.
Object Access	File System, Registry, Detailed File Share, SAM.	4656, 4663, 5140, 5145	Tracks access to confidential folders, intellectual property shares, and registry keys.
Privilege Use	Sensitive Privilege Use, Non-Sensitive Privilege Use.	4673, 4674	Monitors SeDebugPrivilege abuse and credential extraction attempts (e.g., Mimikatz).

Querying the Current Audit Policy Configuration

To inspect active audit rules, launch an elevated Administrator Command Prompt or PowerShell terminal.

1. Listing All Available Subcategories

To view all 53 configurable subcategories supported by your Windows 11 installation:

auditpol /list /subcategory:*

2. Inspecting Current Category Settings

To view the current enforcement state for a specific category (e.g., Detailed Tracking):

auditpol /get /category:"Detailed Tracking"

To export a complete audit report of every category and subcategory across the local operating system:

auditpol /get /category:*

The output explicitly categorises each subcategory as: No Auditing, Success, Failure, or Success and Failure.

Enforcing Advanced Audit Policies via auditpol /set

The auditpol /set command applies immediate, live modifications to the kernel audit policy without requiring a system reboot.

1. Auditing Process Creation and Command-Line Telemetry

Monitoring child process spawning is the single most valuable telemetry source for detecting malware execution, PowerShell exploitation, and LOLBIN abuse. Configure Process Creation to record both successes and failures:

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

To ensure Windows records the full command-line string (including arguments and decoded scripts) inside Event ID 4688, enable the accompanying registry policy:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

2. Monitoring Failed Logons and Account Lockouts

To capture malicious brute-force attempts and lateral movement over RDP and SMB:

auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /failure:enable
auditpol /set /subcategory:"Special Logon" /success:enable

Enabling Special Logon generates Event ID 4672 whenever a user logs in with high-level administrative privileges (such as SeDebugPrivilege or SeBackupPrivilege).

3. Auditing File System and Registry Object Access

Tracking modifications to sensitive operating system folders or confidential financial shares requires enabling the subcategory:

auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Note: Enabling the File System subcategory primes the kernel engine; to trigger events on specific folders, you must also define System Access Control Lists (SACLs) via the folder’s Properties > Security > Advanced > Auditing tab.

Backing Up, Restoring, and Clearing Audit Baselines

Enterprise change management requires creating verifiable policy snapshots prior to applying configuration baselines.

1. Exporting Policy to a CSV Template

To export your hardened audit baseline into a standardized comma-separated values (CSV) archive:

auditpol /backup /file:"C:\Security\AuditBaseline_Win11.csv"

2. Restoring Audit Policies Across Fleet Machines

To apply a pre-configured audit policy snapshot onto a newly provisioned Windows 11 endpoint:

auditpol /restore /file:"C:\Security\AuditBaseline_Win11.csv"

3. Clearing Audit Configurations

During forensic troubleshooting or when resetting an appliance to factory baselines, purge all configured subcategory rules:

auditpol /clear /y

The /y flag confirms the purge non-interactively.

Resolving Basic vs. Advanced Group Policy Conflicts

A frequent administrative failure occurs when basic audit policies defined in legacy Group Policy Objects (GPOs) overwrite granular Advanced Audit Policies. To guarantee that Windows strictly respects advanced subcategory policies, enforce the SCENoApplyLegacyAuditPolicy flag:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v SCENoApplyLegacyAuditPolicy /t REG_DWORD /d 1 /f

When this registry key is set to 1, Windows completely ignores basic audit policy settings, preventing domain GPOs from unintentionally degrading endpoint audit depth.

Troubleshooting Common auditpol Administrative Errors

When configuring audit policies, keep the following operational caveats in mind:

• Error 0x00000005 (Access is Denied): The auditpol command strictly requires administrative elevation. If executed inside an unprivileged shell, all modification and query commands will fail. Launch your terminal using Run as administrator.
• Security Event Log Flooding (Event ID 4656/4663): Enabling Object Access across broad directories without tuning SACLs can generate thousands of events per minute, rolling over the 20 MB default Security log capacity in seconds. Expand the maximum Security Log size to at least 1 GB (wevtutil sl Security /ms:1073741824) and target SACLs strictly to critical files.
• Category Name Spelling Errors: Subcategory names passed to /subcategory: must match Windows localization strings exactly. If you receive “The parameter is incorrect”, run auditpol /list /subcategory:* and copy the exact string from the system console output.