auditpol
#
$ target-query <path/to/target> -f auditpol
Module |
|
Output |
|
Module documentation
Plugin that parses audit policy settings from the registry.
Function documentation
Return audit policy settings from the registry.
For Windows, the audit policy settings are stored in the HKEY_LOCAL_MACHINESecurityPolicyPolAdtEv registry key. It shows for each possible audit event if it is logged.
- References: