Usage: AuditPol /get /user[: | /category:*| | ,: | . /subcategory: | ,: | . /option: /sd /r This command displays the current ...

Usage: AuditPol /get [/user[:|<{sid}>]]         [/category:*||<{guid}>[,:|<{guid}>...]]        [/subcategory:|<{guid}>[,:|<{guid}>...]]        [/option:]        [/sd]        [/r] 
 This command displays the current audit policy. 
 Commands   /?               Help (context-sensitive)   /user            The security principal for whom the per-user audit                    policy is queried. Either the /category or /subcategory                    option must be specified. The user may be specified as                    a SID or name. If no user account is specified, then                    the system audit policy is queried.   /category        One or more audit categories specified by GUID or name.                    An asterisk ("*") may be used to indicate that all audit                     categories should be queried.   /subcategory     One or more audit subcategories specified by GUID or                     name.   /sd              Retrieves the security descriptor used to delegate                    access to the audit policy.   /option          Retrieve existing policy for CrashOnAuditFail,                    FullPrivilegeAuditing, AuditBaseObjects or                     AuditBaseDirectories.   /r               Display the output in report (CSV) format. 
 Sample usage:    auditpol /get /user:domain\user /Category:"Detailed Tracking","Object Access"   auditpol /get /Subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /r   auditpol /get /option:CrashOnAuditFail   auditpol /get /user:{S-1-5-21-397123417-1234567} /Category:"System"   auditpol /get /sd