Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

here's a script to turn on an audit rule:

$path = 'C:\...\*'
$ACL = new-object System.Security.AccessControl.FileSecurity
$AccessRule = new-object System.Security.AccessControl.FileSystemAuditRule("everyone","ExecuteFile","success")
$ACL.SetAuditRule($AccessRule)

$dircont = gci $path -include "*.dot"
foreach ($file in $dircont)
    	{
    	$ACL | Set-Acl $file
    	}

BUT what I want to be able to do is, for any given file, remove any and all auditing rules. So let's say you don't know what users have auditing set or for what actions, you just want to get rid of it all... Like I think I could do something like:

$AccessRule = new-object System.Security.AccessControl.FileSystemAuditRule("everyone","ExecuteFile","none")

But that only helps if you know what users are already configured to be audited on that file... hope this makes sense. Thanks for any help.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

it's a bit more tricky to remove rules, you will have to look at every file...

foreach($file in $somewhere) 
{
  $acl = Get-Acl $file
  $acl.GetAuditRules($True, $False, [System.Security.Principal.SecurityIdentifier]) |Foreach-Object { $acl.RemoveAuditRule($_); }
  Set-Acl $file $acl
}

Documentation for GetAuditRules (and its cryptic parameters)

share|improve this answer
    
Thanks a bunch for that. Very useful! –  Jordan W. Jun 23 '09 at 23:00

This doesn't address your question, I don't know how, but your script can be cleaned up just a bit:

$path = 'C:\...\*'
$ACL = new-object Security.AccessControl.FileSecurity
$AccessRule = new-object Security.AccessControl.FileSystemAuditRule `
                   everyone, ExecuteFile, success
$ACL.SetAuditRule($AccessRule)
gci $path -filter *.dot | Set-Acl -acl $ACL
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.