Repository navigation
New‑NTFSAuditRule
raandree edited this page Sep 6, 2026
·
1 revision
Creates a reusable NTFS audit rule.
New-NTFSAuditRule [-Account] <String[]> [-AccessRights] <Object> [-AuditFlags] <AuditFlags>
[[-AppliesTo] <String>] [<CommonParameters>]
Creates an in-memory audit rule with an account, rights, success or failure flags, and an Explorer-style inheritance scope.
New-NTFSAuditRule -Account 'CONTOSO\Analysts' -AccessRights Write -AuditFlags Failure
Creates a rule that audits failed write attempts by the Analysts group.
The filesystem rights represented by the new audit rule. A raw access mask is also accepted as a decimal number or a hexadecimal string, so bits the FileSystemRights enumeration cannot name, such as the generic rights, can be used.
Type: Object
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThe account name or SID to which the new audit rule applies.
Type: String[]
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: FalseSpecifies how the rule applies to a directory and its child files or directories using names that correspond to Windows Explorer.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: ThisFolderSubfoldersAndFiles
Accept pipeline input: False
Accept wildcard characters: FalseSpecifies whether successful access, failed access, or both are audited.
Type: AuditFlags
Parameter Sets: (All)
Aliases:
Accepted values: None, Success, Failure
Required: True
Position: 3
Default value: None
Accept pipeline input: False
Accept wildcard characters: FalseThis cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
- Add-ADObjectAccessRule
- Add-CertificatePrivateKeyAccessRule
- Add-NTFSAccessRule
- Add-NTFSAuditRule
- Add-ProcessAccessRule
- Add-ProcessAuditRule
- Add-RegistryKeyAccessRule
- Add-RegistryKeyAuditRule
- Add-ScheduledTaskAccessRule
- Add-ServiceAccessRule
- Add-ServiceAuditRule
- Add-SmbShareAccessRule
- Add-TaskFolderAccessRule
- Backup-NTFSItemSecurityDescriptor
- Backup-WindowsSecurityDescriptor
- Clear-ADObjectAccessRule
- Clear-NTFSAccessRule
- Clear-NTFSAuditRule
- Clear-ProcessAccessRule
- Clear-ProcessAuditRule
- Clear-RegistryKeyAccessRule
- Clear-RegistryKeyAuditRule
- Clear-ServiceAccessRule
- Clear-ServiceAuditRule
- Copy-NTFSItemSecurityDescriptor
- Disable-NTFSItemInheritance
- Disable-RegistryKeyInheritance
- Disable-WindowsPrivilege
- Edit-NTFSItemSecurityDescriptor
- Edit-RegistryKeySecurityDescriptor
- Enable-NTFSItemInheritance
- Enable-RegistryKeyInheritance
- Enable-WindowsPrivilege
- Get-ADObjectAccessRule
- Get-ADObjectCallerEffectiveAccess
- Get-ADObjectSchemaDefaultAccessRule
- Get-ADObjectSecurityDescriptor
- Get-CertificatePrivateKeyAccessRule
- Get-CertificatePrivateKeySecurityDescriptor
- Get-NTFSAccessRule
- Get-NTFSAuditRule
- Get-NTFSItemEffectiveAccess
- Get-NTFSItemInheritance
- Get-NTFSItemOwner
- Get-NTFSItemSecurityDescriptor
- Get-ProcessAccessRule
- Get-ProcessAuditRule
- Get-ProcessSecurityDescriptor
- Get-RegistryKeyAccessRule
- Get-RegistryKeyAuditRule
- Get-RegistryKeyInheritance
- Get-RegistryKeySecurityDescriptor
- Get-ScheduledTaskAccessRule
- Get-ScheduledTaskSecurityDescriptor
- Get-ServiceAccessRule
- Get-ServiceAuditRule
- Get-ServiceSecurityDescriptor
- Get-SmbShareAccessRule
- Get-SmbShareEffectiveAccess
- Get-SmbShareSecurityDescriptor
- Get-TaskFolderAccessRule
- Get-TaskFolderSecurityDescriptor
- Get-WindowsAccessControlMetric
- Get-WindowsPrivilege
- Invoke-WindowsAccessControl
- New-NTFSAccessRule
- New-NTFSAuditRule
- Remove-ADObjectAccessRule
- Remove-CertificatePrivateKeyAccessRule
- Remove-NTFSAccessRule
- Remove-NTFSAuditRule
- Remove-ProcessAccessRule
- Remove-ProcessAuditRule
- Remove-RegistryKeyAccessRule
- Remove-RegistryKeyAuditRule
- Remove-ScheduledTaskAccessRule
- Remove-ServiceAccessRule
- Remove-ServiceAuditRule
- Remove-SmbShareAccessRule
- Remove-TaskFolderAccessRule
- Resolve-WindowsIdentity
- Restore-NTFSItemSecurityDescriptor
- Restore-WindowsSecurityDescriptor
- Set-ADObjectAccessRule
- Set-ADObjectSecurityDescriptor
- Set-CertificatePrivateKeySecurityDescriptor
- Set-NTFSAccessRule
- Set-NTFSAuditRule
- Set-NTFSItemOwner
- Set-NTFSItemSecurityDescriptor
- Set-ProcessAccessRule
- Set-ProcessAuditRule
- Set-ProcessSecurityDescriptor
- Set-RegistryKeyAccessRule
- Set-RegistryKeyAuditRule
- Set-RegistryKeySecurityDescriptor
- Set-ScheduledTaskSecurityDescriptor
- Set-ServiceAccessRule
- Set-ServiceAuditRule
- Set-ServiceSecurityDescriptor
- Set-SmbShareSecurityDescriptor
- Set-TaskFolderSecurityDescriptor
- Test-CertificatePrivateKeyCriticalBinding
- Test-NTFSItemAcl
- Test-WindowsPrivilege
- WindowsAccessControlADObjectAccessRule
- WindowsAccessControlADObjectSecurityDescriptor
- WindowsAccessControlCertificatePrivateKeyAccessRule
- WindowsAccessControlCertificatePrivateKeySecurityDescriptor
- WindowsAccessControlNtfsAccessRule
- WindowsAccessControlNtfsSecurityDescriptor
- WindowsAccessControlProcessAccessRule
- WindowsAccessControlProcessSecurityDescriptor
- WindowsAccessControlRegistryKeyAccessRule
- WindowsAccessControlRegistryKeySecurityDescriptor
- WindowsAccessControlScheduledTaskAccessRule
- WindowsAccessControlScheduledTaskSecurityDescriptor
- WindowsAccessControlServiceAccessRule
- WindowsAccessControlServiceControlManagerAccessRule
- WindowsAccessControlServiceControlManagerSecurityDescriptor
- WindowsAccessControlServiceSecurityDescriptor
- WindowsAccessControlSmbShareAccessRule
- WindowsAccessControlSmbShareSecurityDescriptor
- WindowsAccessControlTaskFolderAccessRule
- WindowsAccessControlTaskFolderSecurityDescriptor