Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

here's a script to turn on an audit rule:

$path = 'C:\...\*'
$ACL = new-object System.Security.AccessControl.FileSecurity
$AccessRule = new-object System.Security.AccessControl.FileSystemAuditRule("everyone","ExecuteFile","success")

$dircont = gci $path -include "*.dot"
foreach ($file in $dircont)
    	$ACL | Set-Acl $file

BUT what I want to be able to do is, for any given file, remove any and all auditing rules. So let's say you don't know what users have auditing set or for what actions, you just want to get rid of it all... Like I think I could do something like:

$AccessRule = new-object System.Security.AccessControl.FileSystemAuditRule("everyone","ExecuteFile","none")

But that only helps if you know what users are already configured to be audited on that file... hope this makes sense. Thanks for any help.

share|improve this question
up vote 3 down vote accepted

it's a bit more tricky to remove rules, you will have to look at every file...

foreach($file in $somewhere) 
  $acl = Get-Acl $file
  $acl.GetAuditRules($True, $False, [System.Security.Principal.SecurityIdentifier]) |Foreach-Object { $acl.RemoveAuditRule($_); }
  Set-Acl $file $acl

Documentation for GetAuditRules (and its cryptic parameters)

share|improve this answer
Thanks a bunch for that. Very useful! – Jordan W. Jun 23 '09 at 23:00

This doesn't address your question, I don't know how, but your script can be cleaned up just a bit:

$path = 'C:\...\*'
$ACL = new-object Security.AccessControl.FileSecurity
$AccessRule = new-object Security.AccessControl.FileSystemAuditRule `
                   everyone, ExecuteFile, success
gci $path -filter *.dot | Set-Acl -acl $ACL
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.