Usage: AuditPol /get /user[: | /category:*| | ,: | . /subcategory: | ,: | . /option: /sd /r This command displays the current ...

Usage: AuditPol /get [/user[:|<{sid}>]]
       [/category:*||<{guid}>[,:|<{guid}>...]]
       [/subcategory:|<{guid}>[,:|<{guid}>...]]
       [/option:]
       [/sd]
       [/r]


This command displays the current audit policy.


Commands
  /?               Help (context-sensitive)
  /user            The security principal for whom the per-user audit
                   policy is queried. Either the /category or /subcategory
                   option must be specified. The user may be specified as
                   a SID or name. If no user account is specified, then
                   the system audit policy is queried.
  /category        One or more audit categories specified by GUID or name.
                   An asterisk ("*") may be used to indicate that all audit
                   categories should be queried.
  /subcategory     One or more audit subcategories specified by GUID or
                   name.
  /sd              Retrieves the security descriptor used to delegate
                   access to the audit policy.
  /option          Retrieve existing policy for CrashOnAuditFail,
                   FullPrivilegeAuditing, AuditBaseObjects or
                   AuditBaseDirectories.
  /r               Display the output in report (CSV) format.


Sample usage:
  auditpol /get /user:domain\user /Category:"Detailed Tracking","Object Access"
  auditpol /get /Subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /r
  auditpol /get /option:CrashOnAuditFail
  auditpol /get /user:{S-1-5-21-397123417-1234567} /Category:"System"
  auditpol /get /sd