Usage: AuditPol /set /user[: | ][/include][/exclude /category: | ,: | . /success: | ][/failure: | /subcategory: | ,: | . ...

Usage: AuditPol /set
       [/user[:|<{sid}>][/include][/exclude]]
       [/category:|<{guid}>[,:|<{guid}>...]]
          [/success:|][/failure:|]
       [/subcategory:|<{guid}>[,:|<{guid}>...]]
          [/success:|][/failure:|]
       [/option: /value:|]


This command sets the current audit policy.


Commands
  /?               Help (context-sensitive)
  /user            The security principal for whom per-user audit policy
                   specified by the category/subcategory is set. Either
                   the category or subcategory option must be specified,
                   as a SID or name.
  /include         Specified with /user; indicates that user's per-user
                   policy will cause audit to be generated even if not
                   specified by the system audit policy. This setting is
                   the default and is automatically applied if neither
                   the /include nor /exclude options are explicitly
                   specified.
  /exclude         Specified with /user; indicates that the user's per-user
                   policy will cause audit to be suppressed regardless of
                   the system audit policy. This setting is not honored for
                   users who are members of the Administrators local group.
  /category        One or more audit categories specified by GUID or name.
                   If no user is specified, the system policy is set.
  /subcategory     One or more audit subcategories specified by GUID or
                   name. If no user is specified, system policy is set.
  /success         Specifies success auditing. This setting is the default
                   and is automatically applied if neither the /success nor
                   /failure options are explicitly specified. This setting
                   must be used with a parameter indicating whether to
                   enable or disable the setting.
  /failure         Specifies failure auditing. This setting must be used with
                   a parameter indicating whether to enable or disable the
                   setting.
  /option          Set the audit policy for CrashOnAuditFail,
                   FullPrivilegeAuditing, AuditBaseObjects or
                   AuditBaseDirectories.
  /sd              Sets the security descriptor used to delegate access
                   to the audit policy. The security descriptor must be
                   specified using SDDL. The security descriptor must have a
                   DACL.


Example:
  auditpol /set /user:domain\user /Category:"System" /success:enable /include
  auditpol /set /subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /failure:disable
  auditpol /set /option:CrashOnAuditFail /value:enable
  auditpol /set /sd:D:(A;;DCSWRPDTRC;;;BA)(A;;DCSWRPDTRC;;;SY)