Set‑RegistryKeyAuditRule

SYNOPSIS

Replaces matching audit rules on local registry keys.

SYNTAX

SecurityDescriptor (Default)

Set-RegistryKeyAuditRule -SecurityDescriptor <PSObject> -Account <Object[]> -AccessRights <RegistryRights>
 [-AuditFlags <AuditFlags>] [-AppliesTo <String>] [-RegistryView <WindowsRegistryView>]
 [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf] [-Confirm]
 [<CommonParameters>]

Path

Set-RegistryKeyAuditRule [-Path] <Object[]> -Account <Object[]> -AccessRights <RegistryRights>
 [-AuditFlags <AuditFlags>] [-AppliesTo <String>] [-RegistryView <WindowsRegistryView>]
 [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf] [-Confirm]
 [<CommonParameters>]

DESCRIPTION

Removes explicit registry audit rules for each selected SID and audit flag combination, adds the replacement, and persists each SACL once.

EXAMPLES

EXAMPLE 1

Set-RegistryKeyAuditRule -Path HKCU:\Software -Account Everyone -AccessRights SetValue -AuditFlags Failure -Confirm:$false

Replaces the matching Everyone audit rule.

PARAMETERS

-AccessRights

Registry rights stored in each replacement audit rule.

Type: RegistryRights
Parameter Sets: (All)
Aliases:
Accepted values: QueryValues, SetValue, CreateSubKey, EnumerateSubKeys, Notify, CreateLink, Delete, ReadPermissions, WriteKey, ExecuteKey, ReadKey, ChangePermissions, TakeOwnership, FullControl

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Account

One or more account names, SID strings, identity references, or module identities.

Type: Object[]
Parameter Sets: (All)
Aliases: IdentityReference, ID

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-AppliesTo

Controls whether the audit ACE applies to this key, subkeys, or one level.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: ThisKeyOnly
Accept pipeline input: False
Accept wildcard characters: False

-AuditFlags

Selects successful access, failed access, or both for auditing.

Type: AuditFlags
Parameter Sets: (All)
Aliases:
Accepted values: None, Success, Failure

Required: False
Position: Named
Default value: Success
Accept pipeline input: False
Accept wildcard characters: False

-PassThru

Returns each stored replacement rule after persistence.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-Path

One or more local registry key paths or RegistryKey pipeline objects.

Type: Object[]
Parameter Sets: Path
Aliases: PSPath

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-RegistryView

Selects the default, 32-bit, or 64-bit registry view explicitly.

Type: WindowsRegistryView
Parameter Sets: (All)
Aliases:
Accepted values: Default, Registry32, Registry64

Required: False
Position: Named
Default value: Default
Accept pipeline input: False
Accept wildcard characters: False

-SecurityDescriptor

A WindowsAccessControl.RegistryKeySecurityDescriptor object returned by Get-RegistryKeySecurityDescriptor with the Audit section loaded. When supplied, matching rules are replaced on the descriptor in memory and the descriptor is returned; nothing is written until Set-RegistryKeySecurityDescriptor persists it.

Type: PSObject
Parameter Sets: SecurityDescriptor
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-ThrottleLimit

Limits concurrently processed canonical targets. One requests deterministic sequential execution.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.String

Microsoft.Win32.RegistryKey

WindowsAccessControl.RegistryKeySecurityDescriptor

OUTPUTS

None

WindowsAccessControl.RegistryKeyAuditRule

WindowsAccessControl.RegistryKeySecurityDescriptor

NOTES

RELATED LINKS