Advanced Audit Policy configuration using PowerShell

Question

I created a GPO to enable advanced audit policies and Security settings.

Related policy settings

I need to edit and enable the settings using PowerShell.

What are the related registry keys?

How can I edit using PowerShell?

Could you help me please?

Thanks in advance!

Answer 1

The audit settings and some security settings aren't registry values. They are stored in the secedit.sdb database.

If you need to change the advanced audit settings from the command prompt, you may use auditpol.exe.

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-get

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit