auditpol /get

auditpol /get /category:*

Displays the complete system audit policy with auditpol, verifying which events are logged (and which are not) on the host.

Run it when you need to know what is being audited on the host: auditpol /get /category:* shows the status of all audit categories — logon, processes, accounts, object access, policy changes — with their configuration (success/failure). It is the verification of the audit baseline: the SIEM only sees what the policy logs, and disabled categories are the visibility gaps. In hardening and IR, the auditpol review is one of the first checks: logon without auditing or processes without auditing mean the attack left no events. The policy is compared against the baseline (CIS/Microsoft) and disabled categories are enabled.

Do not use it as detection: auditpol shows the policy, not the events — events live in the Security log and are analyzed with the usual tools. The default Windows policy is minimal (many categories disabled): the full baseline (Microsoft/CIS recommendations) is applied with auditpol /set or GPO — enabling everything generates volume and cost; the policy is calibrated with risk. And note: the displayed policy is the effective one on the host (local + GPO): differences between what the GPO defines and what the host has are resolved with gpresult. On hosts where auditing was disabled by the attacker, the review shows the degradation.