salt.modules.win_auditpol¶

A salt module for modifying the audit policies on the machine

Though this module does not set group policy for auditing, it displays how all auditing configuration is applied on the machine, either set directly or via local or domain group policy.

This module allows you to view and modify the audit settings as they are applied on the machine. The audit settings are broken down into nine categories:

• Account Logon
• Account Management
• Detailed Tracking
• DS Access
• Logon/Logoff
• Object Access
• Policy Change
• Privilege Use
• System

The get_settings function will return the subcategories for all nine of the above categories in one dictionary along with their auditing status.

To modify a setting you only need to specify the subcategory name and the value you wish to set. Valid settings are:

• No Auditing
• Success
• Failure
• Success and Failure

CLI Example:

# Get current state of all audit settings
salt * auditpol.get_settings

# Get the current state of all audit settings in the "Account Logon"
# category
salt * auditpol.get_settings category="Account Logon"

# Get current state of the "Credential Validation" setting
salt * auditpol.get_setting name="Credential Validation"

# Set the state of the "Credential Validation" setting to Success and
# Failure
salt * auditpol.set_setting name="Credential Validation" value="Success and Failure"

# Set the state of the "Credential Validation" setting to No Auditing
salt * auditpol.set_setting name="Credential Validation" value="No Auditing"

salt.modules.win_auditpol.get_setting(name)¶

Get the current configuration for the named audit setting

Parameters:	name (str) -- The name of the setting to retrieve
Returns:	The current configuration for the named setting
Return type:	str
Raises:	KeyError -- On invalid setting name CommandExecutionError -- If an error is encountered retrieving the settings

CLI Example:

# Get current state of the "Credential Validation" setting
salt * auditpol.get_setting "Credential Validation"

salt.modules.win_auditpol.get_settings(category='All')¶

Get the current configuration for all audit settings specified in the category

Parameters:	category (str) -- One of the nine categories to return. Can also be All to return the settings for all categories. Valid options are: Account Logon Account Management Detailed Tracking DS Access Logon/Logoff Object Access Policy Change Privilege Use System All Default value is All
Returns:	A dictionary containing all subcategories for the specified category along with their current configuration
Return type:	dict
Raises:	KeyError -- On invalid category CommandExecutionError -- If an error is encountered retrieving the settings

CLI Example:

# Get current state of all audit settings
salt * auditipol.get_settings

# Get the current state of all audit settings in the "Account Logon"
# category
salt * auditpol.get_settings "Account Logon"

salt.modules.win_auditpol.set_setting(name, value)¶

Set the configuration for the named audit setting

Parameters:	name (str) -- The name of the setting to configure value (str) -- The configuration for the named value. Valid options are: No Auditing Success Failure Success and Failure
Returns:	True if successful
Return type:	bool
Raises:	KeyError -- On invalid name or value CommandExecutionError -- If an error is encountered modifying the setting

CLI Example:

# Set the state of the "Credential Validation" setting to Success and
# Failure
salt * auditpol.set_setting "Credential Validation" "Success and Failure"

# Set the state of the "Credential Validation" setting to No Auditing
salt * auditpol.set_setting "Credential Validation" "No Auditing"