API Reference
AuditOptionsState
Current values for key Advanced Audit Policy options. Null means “not queried / unchanged”.
Inheritance
- Object
- AuditOptionsState
Constructors
public AuditOptionsState() #Inherited Methods
public override Boolean Equals(Object obj) #BooleanParameters
- obj Object
Properties
public Nullable<Boolean> ForceSubcategoryOverride { get; set; } #Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. Maps to HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy (1 = enabled).
public Nullable<Boolean> AuditBaseObjects { get; set; } #Audit: Audit the access of global system objects. HKLM\SYSTEM\CurrentControlSet\Control\Lsa\AuditBaseObjects (1 = enabled).
public Nullable<Boolean> AuditBaseDirectories { get; set; } #Audit: Audit the access of backup and restore privilege on directories. HKLM\SYSTEM\CurrentControlSet\Control\Lsa\AuditBaseDirectories (1 = enabled).
public Nullable<Int32> CrashOnAuditFail { get; set; } #Audit: Shut down system immediately if unable to log security audits. HKLM\SYSTEM\CurrentControlSet\Control\Lsa\CrashOnAuditFail (0 disabled, 1 legacy, 2 enabled strict). We expose it as an integer to preserve nuance; set to 0 or 2 in most environments.