Auditpol remove

Applies To: Windows Server 2008 R2,Windows Server 2008,Windows Vista,Windows 7

Removes the per-user audit policy for a specified account or all accounts.

For examples of how this command can be used, see Examples.

Syntax

	$lib:\\auditpolremove.bmp$ Copy Code
Auditpol /remove [/user[:<username>\|<{SID}>]] [/allusers]

Parameters

Parameter	Description
/user	Specifies the security identifier (SID) or user name for the user for whom the per-user audit policy is to be deleted.
/allusers	Removes the per-user audit policy for all users.
/?	Displays help at the command prompt.

Remarks

For remove operations for the per-user policy, you must have Write or Full Control permission on that object set in the security descriptor. You can also perform remove operations by possessing the Manage auditing and security log (SeSecurityPrivilege) user right. However, this right allows additional access that is not necessary to perform the remove operation.

Examples

To remove the per-user audit policy for user mikedan by name, type:

	$lib:\\auditpolremove1.bmp$ Copy Code
Auditpol /remove /user:mikedan

To remove the per-user audit policy for user mikedan by SID, type:

	$lib:\\auditpolremove2.bmp$ Copy Code
Auditpol /remove /user:{S-1-5-21-397123471-12346959}

To remove the per-user audit policy for all users, type:

	$lib:\\auditpolremove3.bmp$ Copy Code
Auditpol /remove /allusers

Additional references

Command-Line Syntax Key