API Reference
Class
RegistryAuditPolicyDb
Reads/writes the raw audit policy registry database (HKLM\SECURITY\Policy\PolAdtEv) and converts to/from subcategory settings.
Inheritance
- Object
- RegistryAuditPolicyDb
Methods
public static AuditPolicyDbBackupResult Backup(AuditPolicyDbBackupOptions options) #Returns:
AuditPolicyDbBackupResultCreates a binary backup of PolAdtEv and optionally emits JSON and .reg files.
Parameters
- options ComputerX.Audit.AuditPolicyDbBackupOptions
public static List<AuditSubcategorySetting> Decode(Byte[] data, AuditOsLayout layout = Unknown) #Returns:
List<AuditSubcategorySetting>Decodes raw registry DB bytes into subcategory settings using an OS layout map.
Parameters
- data System.Byte[]
- layout ComputerX.Audit.AuditOsLayout = Unknown
public static RegistryDiagnostics DiagnoseAccess(String host) #Returns:
RegistryDiagnosticsPerforms comprehensive diagnostics on registry access for audit policy.
Parameters
- host System.String
public static Boolean EncodeAndWrite(String host, IEnumerable<AuditSubcategorySetting> items, out String backupPath, Boolean adjustAcl) #Returns:
BooleanEncodes provided settings back into the DB and writes them, optionally adjusting ACLs temporarily.
Parameters
- host System.String
- items System.Collections.Generic.IEnumerable{ComputerX.Audit.AuditSubcategorySetting}
- backupPath System.String@
- adjustAcl System.Boolean
public static RegistryAuditResult TryRead(String host, Boolean adjustAcl = false) #Returns:
RegistryAuditResultReads the PolAdtEv value from the target host (local or remote).
Parameters
- host System.String
- Target computer; null/empty for local.
- adjustAcl System.Boolean = false
- When true, temporarily grants Administrators read access to HKLM\SECURITY\Policy to overcome ACL blocks, then reverts. Use only as a last resort. If cleanup fails, HKLM\SECURITY permissions could remain too broad.
public static Boolean TryWrite(String host, Byte[] data) #Returns:
BooleanWrites the PolAdtEv value to the target host.
Parameters
- host System.String
- data System.Byte[]
Inherited Methods
public override Boolean Equals(Object obj) #Returns:
BooleanInherited from Object
Parameters
- obj Object