>

View the advanced audit policy on Windows (auditpol /get)

Dump every audit subcategory's enabled state in one command — the ground truth of what Windows actually logs before you hunt through Event Viewer.

WindowspolicyloggingauditLow risk
Run auditpol /get /category:* to list the enabled/disabled state of every audit subcategory.

01Command

Command
$ auditpol /get /category:*

02What it does

Group Policy may say one thing while the effective audit state says another; auditpol reads the live per-machine state, including the crucial 'Per User' overlay with /get /user. Its forgotten companion is auditpol /clear /y, which resets everything to No Auditing — dangerous, but the honest way to start from scratch. Before enabling Process Creation with command-line auditing, checking the current Logon/Logoff and Object Access subcategories first prevents surprise event floods.

03Risk

RiskLow risk
RequirementsRun Command Prompt as Administrator

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • auditpol | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents auditpol /get /category as displaying audit policy per category, with /category:* covering all nine categories and their subcategories.
  • AUDITPOL - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: SS64 documents auditpol /get /category:* to list every audit subcategory's enabled/disabled state, and /set to change it.

Last verified: 2026-09-17 · Category: Security & Privacy