Usage: AuditPol /set /user[: | ][/include][/exclude /category: | ,: | . /success: | ][/failure: | /subcategory: | ,: | . ...

Usage: AuditPol /set        [/user[:|<{sid}>][/include][/exclude]]        [/category:|<{guid}>[,:|<{guid}>...]]           [/success:|][/failure:|]        [/subcategory:|<{guid}>[,:|<{guid}>...]]           [/success:|][/failure:|]        [/option: /value:|] 
 This command sets the current audit policy. 
 Commands   /?               Help (context-sensitive)   /user            The security principal for whom per-user audit policy                    specified by the category/subcategory is set. Either                     the category or subcategory option must be specified,                     as a SID or name.   /include         Specified with /user; indicates that user's per-user                    policy will cause audit to be generated even if not                    specified by the system audit policy. This setting is                     the default and is automatically applied if neither                     the /include nor /exclude options are explicitly                     specified.   /exclude         Specified with /user; indicates that the user's per-user                    policy will cause audit to be suppressed regardless of                    the system audit policy. This setting is not honored for                     users who are members of the Administrators local group.   /category        One or more audit categories specified by GUID or name.                     If no user is specified, the system policy is set.   /subcategory     One or more audit subcategories specified by GUID or                     name. If no user is specified, system policy is set.   /success         Specifies success auditing. This setting is the default                     and is automatically applied if neither the /success nor                     /failure options are explicitly specified. This setting                     must be used with a parameter indicating whether to                     enable or disable the setting.   /failure         Specifies failure auditing. This setting must be used with                     a parameter indicating whether to enable or disable the                     setting.   /option          Set the audit policy for CrashOnAuditFail,                    FullPrivilegeAuditing, AuditBaseObjects or                    AuditBaseDirectories.   /sd              Sets the security descriptor used to delegate access                     to the audit policy. The security descriptor must be                     specified using SDDL. The security descriptor must have a                    DACL.  
 Example:    auditpol /set /user:domain\user /Category:"System" /success:enable /include   auditpol /set /subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /failure:disable   auditpol /set /option:CrashOnAuditFail /value:enable   auditpol /set /sd:D:(A;;DCSWRPDTRC;;;BA)(A;;DCSWRPDTRC;;;SY)