Set-CxAuditPolicy

Namespace ComputerX.PowerShell

Inputs

ComputerX.Audit.AuditSubcategorySetting[]

Sets advanced Audit Policy on a local or remote Windows host.

Examples

Authored help example

Example 1


$items = Get-CxAuditPolicy -Source LocalPolicyCsv | ? Subcategory -eq 'Process Creation'; $items[0].Flags = 'SuccessAndFailure'; Set-CxAuditPolicy -Source LocalPolicyCsv -Items $items -RefreshPolicy

Example 2


$items = Get-CxAuditPolicy -ComputerName SRV1 -Source Registry; $items | % { if ($_.Subcategory -eq 'Logon') { $_.Flags = 'SuccessAndFailure' } }; Set-CxAuditPolicy -ComputerName SRV1 -Source Registry -Items $items -AdjustRegistryAcl -BackupBefore -WhatIf

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.

Syntax

Set-CxAuditPolicy [-ComputerName <string>] -Source <Native|LocalPolicyCsv|Registry> -Items <AuditSubcategorySetting[]> [-AdjustRegistryAcl] [-BackupBefore] [-RefreshPolicy] [<CommonParameters>]

Parameters

ComputerName string optionalposition: 0pipeline: false: Target host. If omitted, sets the local machine.
Source AuditPolicySource requiredposition: 1pipeline: falsevalues: 3: Data source to write: LocalPolicyCsv, Native, or Registry. Possible values: Native, LocalPolicyCsv, Registry; Possible values: Native, LocalPolicyCsv, Registry
Items AuditSubcategorySetting[] requiredposition: 2pipeline: true (ByValue): Audit subcategory settings to apply (can be piped from Get-CxAuditPolicy).
AdjustRegistryAcl SwitchParameter optionalposition: namedpipeline: false: When using Registry source, temporarily relax ACL on the policy hive to allow writes.
BackupBefore SwitchParameter optionalposition: namedpipeline: false: Create a backup before applying changes (CSV path or registry binary).
RefreshPolicy SwitchParameter optionalposition: namedpipeline: false: For CSV source: on local host, runs 'gpupdate /force' after writing Audit.csv.