Repository navigation
Add‑ServiceAuditRule
raandree edited this page Sep 6, 2026
·
1 revision
Adds audit rules to local services or the Service Control Manager.
Add-ServiceAuditRule [-Name] <Object[]> -Account <Object[]> -ServiceRights <WindowsServiceRights>
[-AuditFlags <AuditFlags>] [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf]
[-Confirm] [<CommonParameters>]
Add-ServiceAuditRule [-ServiceControlManager] -Account <Object[]>
-ControlManagerRights <WindowsServiceControlManagerRights> [-AuditFlags <AuditFlags>] [-ThrottleLimit <Int32>]
[-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]
Resolves and deduplicates accounts before adding explicit SACL ACEs with typed rights and scoped SeSecurityPrivilege for each target.
Add-ServiceAuditRule -Name BITS -Account Everyone -ServiceRights Start -AuditFlags Failure -WhatIf
Previews adding a failed-start audit rule to BITS.
One or more account names, SIDs, identity references, or module identities.
Type: Object[]
Parameter Sets: (All)
Aliases: IdentityReference, ID
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseSelects successful access, failed access, or both for auditing.
Type: AuditFlags
Parameter Sets: (All)
Aliases:
Accepted values: None, Success, Failure
Required: False
Position: Named
Default value: Success
Accept pipeline input: False
Accept wildcard characters: FalseRights audited by each Service Control Manager rule.
Type: WindowsServiceControlManagerRights
Parameter Sets: ServiceControlManager
Aliases:
Accepted values: Connect, CreateService, EnumerateService, Lock, QueryLockStatus, ModifyBootConfig, Delete, ReadControl, WriteDac, WriteOwner, AllAccess, AccessSystemSecurity, GenericAll, GenericExecute, GenericWrite, GenericRead
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseOne or more local service names, ServiceController objects, or module outputs.
Type: Object[]
Parameter Sets: Service
Aliases: ServiceName
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: FalseReturns each stored explicit audit rule after persistence.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: FalseSelects the local Service Control Manager instead of a named service.
Type: SwitchParameter
Parameter Sets: ServiceControlManager
Aliases:
Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: FalseRights audited by each named-service rule.
Type: WindowsServiceRights
Parameter Sets: Service
Aliases:
Accepted values: QueryConfig, ChangeConfig, QueryStatus, EnumerateDependents, Start, Stop, PauseContinue, Interrogate, UserDefinedControl, Delete, ReadControl, WriteDac, WriteOwner, AllAccess, Synchronize, AccessSystemSecurity, GenericAll, GenericExecute, GenericWrite, GenericRead
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseLimits concurrently processed canonical targets. One requests deterministic sequential execution.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: FalsePrompts you for confirmation before running the cmdlet.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseShows what would happen if the cmdlet runs. The cmdlet is not run.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
- Add-ADObjectAccessRule
- Add-CertificatePrivateKeyAccessRule
- Add-NTFSAccessRule
- Add-NTFSAuditRule
- Add-ProcessAccessRule
- Add-ProcessAuditRule
- Add-RegistryKeyAccessRule
- Add-RegistryKeyAuditRule
- Add-ScheduledTaskAccessRule
- Add-ServiceAccessRule
- Add-ServiceAuditRule
- Add-SmbShareAccessRule
- Add-TaskFolderAccessRule
- Backup-NTFSItemSecurityDescriptor
- Backup-WindowsSecurityDescriptor
- Clear-ADObjectAccessRule
- Clear-NTFSAccessRule
- Clear-NTFSAuditRule
- Clear-ProcessAccessRule
- Clear-ProcessAuditRule
- Clear-RegistryKeyAccessRule
- Clear-RegistryKeyAuditRule
- Clear-ServiceAccessRule
- Clear-ServiceAuditRule
- Copy-NTFSItemSecurityDescriptor
- Disable-NTFSItemInheritance
- Disable-RegistryKeyInheritance
- Disable-WindowsPrivilege
- Edit-NTFSItemSecurityDescriptor
- Edit-RegistryKeySecurityDescriptor
- Enable-NTFSItemInheritance
- Enable-RegistryKeyInheritance
- Enable-WindowsPrivilege
- Get-ADObjectAccessRule
- Get-ADObjectCallerEffectiveAccess
- Get-ADObjectSchemaDefaultAccessRule
- Get-ADObjectSecurityDescriptor
- Get-CertificatePrivateKeyAccessRule
- Get-CertificatePrivateKeySecurityDescriptor
- Get-NTFSAccessRule
- Get-NTFSAuditRule
- Get-NTFSItemEffectiveAccess
- Get-NTFSItemInheritance
- Get-NTFSItemOwner
- Get-NTFSItemSecurityDescriptor
- Get-ProcessAccessRule
- Get-ProcessAuditRule
- Get-ProcessSecurityDescriptor
- Get-RegistryKeyAccessRule
- Get-RegistryKeyAuditRule
- Get-RegistryKeyInheritance
- Get-RegistryKeySecurityDescriptor
- Get-ScheduledTaskAccessRule
- Get-ScheduledTaskSecurityDescriptor
- Get-ServiceAccessRule
- Get-ServiceAuditRule
- Get-ServiceSecurityDescriptor
- Get-SmbShareAccessRule
- Get-SmbShareEffectiveAccess
- Get-SmbShareSecurityDescriptor
- Get-TaskFolderAccessRule
- Get-TaskFolderSecurityDescriptor
- Get-WindowsAccessControlMetric
- Get-WindowsPrivilege
- Invoke-WindowsAccessControl
- New-NTFSAccessRule
- New-NTFSAuditRule
- Remove-ADObjectAccessRule
- Remove-CertificatePrivateKeyAccessRule
- Remove-NTFSAccessRule
- Remove-NTFSAuditRule
- Remove-ProcessAccessRule
- Remove-ProcessAuditRule
- Remove-RegistryKeyAccessRule
- Remove-RegistryKeyAuditRule
- Remove-ScheduledTaskAccessRule
- Remove-ServiceAccessRule
- Remove-ServiceAuditRule
- Remove-SmbShareAccessRule
- Remove-TaskFolderAccessRule
- Resolve-WindowsIdentity
- Restore-NTFSItemSecurityDescriptor
- Restore-WindowsSecurityDescriptor
- Set-ADObjectAccessRule
- Set-ADObjectSecurityDescriptor
- Set-CertificatePrivateKeySecurityDescriptor
- Set-NTFSAccessRule
- Set-NTFSAuditRule
- Set-NTFSItemOwner
- Set-NTFSItemSecurityDescriptor
- Set-ProcessAccessRule
- Set-ProcessAuditRule
- Set-ProcessSecurityDescriptor
- Set-RegistryKeyAccessRule
- Set-RegistryKeyAuditRule
- Set-RegistryKeySecurityDescriptor
- Set-ScheduledTaskSecurityDescriptor
- Set-ServiceAccessRule
- Set-ServiceAuditRule
- Set-ServiceSecurityDescriptor
- Set-SmbShareSecurityDescriptor
- Set-TaskFolderSecurityDescriptor
- Test-CertificatePrivateKeyCriticalBinding
- Test-NTFSItemAcl
- Test-WindowsPrivilege
- WindowsAccessControlADObjectAccessRule
- WindowsAccessControlADObjectSecurityDescriptor
- WindowsAccessControlCertificatePrivateKeyAccessRule
- WindowsAccessControlCertificatePrivateKeySecurityDescriptor
- WindowsAccessControlNtfsAccessRule
- WindowsAccessControlNtfsSecurityDescriptor
- WindowsAccessControlProcessAccessRule
- WindowsAccessControlProcessSecurityDescriptor
- WindowsAccessControlRegistryKeyAccessRule
- WindowsAccessControlRegistryKeySecurityDescriptor
- WindowsAccessControlScheduledTaskAccessRule
- WindowsAccessControlScheduledTaskSecurityDescriptor
- WindowsAccessControlServiceAccessRule
- WindowsAccessControlServiceControlManagerAccessRule
- WindowsAccessControlServiceControlManagerSecurityDescriptor
- WindowsAccessControlServiceSecurityDescriptor
- WindowsAccessControlSmbShareAccessRule
- WindowsAccessControlSmbShareSecurityDescriptor
- WindowsAccessControlTaskFolderAccessRule
- WindowsAccessControlTaskFolderSecurityDescriptor