Add‑ProcessAuditRule

SYNOPSIS

Adds audit rules to pinned live processes.

SYNTAX

Process (Default)

Add-ProcessAuditRule [-InputObject] <Object[]> -Account <Object[]> -ProcessRights <WindowsProcessRights>
 [-AuditFlags <AuditFlags>] [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf]
 [-Confirm] [<CommonParameters>]

Handle

Add-ProcessAuditRule -Handle <IntPtr[]> -Account <Object[]> -ProcessRights <WindowsProcessRights>
 [-AuditFlags <AuditFlags>] [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf]
 [-Confirm] [<CommonParameters>]

DESCRIPTION

Adds explicit process SACL ACEs under scoped privileges after resolving and deduplicating identities and pinning PID targets by creation time.

EXAMPLES

EXAMPLE 1

Add-ProcessAuditRule -ProcessId $PID -Account Everyone -ProcessRights Terminate -AuditFlags Failure -WhatIf

Previews adding a failed-terminate audit rule to the current process.

PARAMETERS

-Account

One or more account names, SIDs, identity references, or module identities.

Type: Object[]
Parameter Sets: (All)
Aliases: IdentityReference

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-AuditFlags

Selects successful access, failed access, or both for auditing.

Type: AuditFlags
Parameter Sets: (All)
Aliases:
Accepted values: None, Success, Failure

Required: False
Position: Named
Default value: Success
Accept pipeline input: False
Accept wildcard characters: False

-Handle

One or more caller-owned process handles that the module never closes.

Type: IntPtr[]
Parameter Sets: Handle
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-InputObject

One or more PIDs, Process objects, or process objects emitted by this module.

Type: Object[]
Parameter Sets: Process
Aliases: Process, Id, ProcessId

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-PassThru

Returns each stored explicit process audit rule after persistence.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProcessRights

Process rights audited by each selected account rule.

Type: WindowsProcessRights
Parameter Sets: (All)
Aliases:
Accepted values: Terminate, CreateThread, SetSessionId, VmOperation, VmRead, VmWrite, DuplicateHandle, CreateProcess, SetQuota, SetInformation, QueryInformation, SuspendResume, QueryLimitedInformation, SetLimitedInformation, Delete, ReadControl, WriteDac, WriteOwner, Synchronize, AllAccess, AccessSystemSecurity, GenericAll, GenericExecute, GenericWrite, GenericRead

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ThrottleLimit

Limits concurrently processed pinned targets. One requests deterministic sequential execution.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.Int32

System.Diagnostics.Process

OUTPUTS

None

WindowsAccessControl.ProcessAuditRule

NOTES

RELATED LINKS