File: C:/Windows/System32/zh-TW/auditpol.exe.mui
MZ� �� � @ � � � �!�L�!This program cannot be run in DOS mode.
$ 5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R� PE L � ! H
p � @ �E 8 .rdata � @ @.rsrc P F @ @ ,��v
T 8 8 ,��v $ � � 8 .rdata 8 x .rdata$zzzdbg � .rsrc$01 � �j .rsrc$02 >� m�j���O :�B��]��ef�g78,��v � �( � @ � X � p � � � � � � � � � � � �! �@ � pb � � M U I ��� ����Pw�r"�� W��C���%�u� �L+ � � � M U I z h - T W O(u�e_: A u d i t P o l c o m m a n d [ < s u b - c o m m a n d > < o p t i o n s > ]
% n
}T�N ( �k!k�PAQ1��WL� N P}T�N)
/ ? ��f ( �}
NsSBf)
/ g e t o�:y�vMR�v=z8h�SGR0
/ s e t -��[=z8h�SGR0
/ l i s t o�:y�Sx��S�v�SGRCQ }0
/ b a c k u p \=z8h�SGR2QX[�jHh0
/ r e s t o r e �_�jHh���S=z8h�SGR0
/ c l e a r nd�=z8h�SGR0
/ r e m o v e �yd�O(u�3^6b�v�k PO(u�=z8h�SGR0
/ r e s o u r c e S A C L -��[hQ�Wnj�n S A C L
% n
O(u A u d i t P o l < c o m m a n d > / ? �S�S�_�k P}T�N�vs�0}nj�e
� O(u�e_: A u d i t P o l / g e t [ / u s e r [ : < u s e r n a m e > | < { s i d } > ] ]
[ / c a t e g o r y : * | < n a m e > | < { g u i d } > [ , : < n a m e > | < { g u i d } > . . . ] ]
[ / s u b c a t e g o r y : < n a m e > | < { g u i d } > [ , : < n a m e > | < { g u i d } > . . . ] ]
[ / o p t i o n : < o p t i o n n a m e > ]
[ / s d ]
[ / r ]
% n
dk}T�N�So�:y�vMR�v=z8h�SGR0
% n
}T�N
/ ? ��f ( �}
NsSBf)
/ u s e r ���gb�KN�k PO(u��v=z8h�SGR�v�[hQ'`;NԚ0�_�c�[ / c a t e g o r y
b / s u b c a t e g o r y x��0�`�_�O(u S I D b
T1z�Oc�[O(u�0
�*gc�[O(u�3^6b �g�gb��|q}=z8h�SGR0
/ c a t e g o r y �N G U I D b
T1zc�[�v NbY P=z8h^�%R0�`�S�NO(u f_� ( " * " )
�Oh�:y���gb�@b g=z8h^�%R0
/ s u b c a t e g o r y �N G U I D b
T1zc�[�v NbY P=z8hP[^�%R0
/ s d �b�S(u�O�Y>mX[�S
kf}=z8h�SGR�v�[hQ'`�c�CQ0
/ o p t i o n �b�S C r a s h O n A u d i t F a i l 0F u l l P r i v i l e g e A u d i t i n g 0
A u d i t B a s e O b j e c t s b A u d i t B a s e D i r e c t o r i e s �v�s g�SGR0
/ r �N1Xh� ( C S V ) <h_o�:y8��Q0
% n
�{�OO(u�e_:
a u d i t p o l / g e t / u s e r : d o m a i n \ u s e r / C a t e g o r y : " D e t a i l e d T r a c k i n g " , " O b j e c t A c c e s s "
a u d i t p o l / g e t / S u b c a t e g o r y : { 0 c c e 9 2 1 2 - 6 9 a e - 1 1 d 9 - b e d 3 - 5 0 5 0 5 4 5 0 3 0 3 0 } / r
a u d i t p o l / g e t / o p t i o n : C r a s h O n A u d i t F a i l
a u d i t p o l / g e t / u s e r : { S - 1 - 5 - 2 1 - 3 9 7 1 2 3 4 1 7 - 1 2 3 4 5 6 7 } / C a t e g o r y : " S y s t e m "
a u d i t p o l / g e t / s d
T O(u�e_: A u d i t P o l / s e t
[ / u s e r [ : < u s e r n a m e > | < { s i d } > ] [ / i n c l u d e ] [ / e x c l u d e ] ]
[ / c a t e g o r y : < n a m e > | < { g u i d } > [ , : < n a m e > | < { g u i d } > . . . ] ]
[ / s u c c e s s : < e n a b l e > | < d i s a b l e > ] [ / f a i l u r e : < e n a b l e > | < d i s a b l e > ]
[ / s u b c a t e g o r y : < n a m e > | < { g u i d } > [ , : < n a m e > | < { g u i d } > . . . ] ]
[ / s u c c e s s : < e n a b l e > | < d i s a b l e > ] [ / f a i l u r e : < e n a b l e > | < d i s a b l e > ]
[ / o p t i o n : < o p t i o n n a m e > / v a l u e : < e n a b l e > | < d i s a b l e > ]
% n
dk}T�N�S-��[�vMR�v=z8h�SGR0
% n
}T�N
/ ? ��f ( �}
NsSBf)
/ u s e r �]-��[^�%R/ P[^�%RKN�k PO(u��v=z8h�SGRc�[�v�[hQ'`;NԚ0
�`�_�O(u S I D b
T1zc�[ c a t e g o r y / s u b c a t e g o r y x��0
/ i n c l u d e -dM� / u s e r Nw�c�[; h�:ysSO�|q}=z8h�SGR*gc�[ �_Ng=z8h
O(u��v�k PO(u��SGR0dk-��[�p�-�-��[ �sSO*gf�xc�[
/ i n c l u d e b / e x c l u d e x�� �_Ng��RWY(u0
/ e x c l u d e -dM� / u s e r Nw�c�[; h�:y
N֊�|q}=z8h�SGR�pUO ���
Ng=z8h
O(u��v�k PO(u��SGR0dk-��[
NgWY(u0Rl\�e,g_j
A d m i n i s t r a t o r s �D}b�T�vO(u�0
/ c a t e g o r y �N G U I D b
T1zc�[�v NbY P=z8h^�%R0
�*gc�[�NUOO(u� �g-��[�|q}�SGR0
/ s u b c a t e g o r y �N G U I D b
T1zc�[�v NbY P=z8hP[^�%R0
�*gc�[�NUOO(u� �g-��[�|q}�SGR0
/ s u c c e s s c�[b�RBf=z8h0dk-��[�p�-�-��[ ��*gf�xc�[ / s u c c e s s b
/ f a i l u r e x�� �_Ng��RWY(u0dk-��[�_�-dM��SxeO(u ��Nc:y
/f��_U(ub\P(u ( e n a b l e b d i s a b l e ) r�-��[0
/ f a i l u r e c�[1YWeBf=z8h0dk-��[�_�-dM��SxeO(u ��Nc:y/f��_U(ub
\P(u ( e n a b l e b d i s a b l e ) r�-��[0
/ o p t i o n -��[ C r a s h O n A u d i t F a i l 0F u l l P r i v i l e g e A u d i t i n g 0
A u d i t B a s e O b j e c t s b A u d i t B a s e D i r e c t o r i e s �v=z8h�SGR0
/ s d -��[(u�e�Y>mX[�S
k�=z8h�SGR�v�[hQ'`�c�CQ0�[hQ'`�c�CQ�_�
O(u S D D L �Oc�[0�[hQ'`�c�CQ�_�wQ g D A C L 0
% n
�{�OO(u�e_:
a u d i t p o l / s e t / u s e r : d o m a i n \ u s e r / C a t e g o r y : " S y s t e m " / s u c c e s s : e n a b l e / i n c l u d e
a u d i t p o l / s e t / s u b c a t e g o r y : { 0 c c e 9 2 1 2 - 6 9 a e - 1 1 d 9 - b e d 3 - 5 0 5 0 5 4 5 0 3 0 3 0 } / f a i l u r e : d i s a b l e
a u d i t p o l / s e t / o p t i o n : C r a s h O n A u d i t F a i l / v a l u e : e n a b l e
a u d i t p o l / s e t / s d : D : ( A ; ; D C S W R P D T R C ; ; ; B A ) ( A ; ; D C S W R P D T R C ; ; ; S Y )
� O(u�e_: A u d i t P o l / l i s t
[ / u s e r | / c a t e g o r y | / s u b c a t e g o r y [ : < c a t e g o r y n a m e > | < { g u i d } > | * ]
[ / v ] [ / r ]
% n
dk}T�N�SR�Q=z8h�SGR^�%R0P[^�%Rbx�� �bR�Q�]�[��k PO(u�=z8h�SGR�vO(u�0
% n
}T�N
/ ? ��f ( �}
NsSBf)
/ u s e r �b�S�]�[��k PO(u�=z8h�SGR�v@b gO(u�0�-dM� / v x��O
(u �_Ngo�:yO(u��v S I D 0
/ c a t e g o r y o�:y�|q}�]�w�v^�%R
T1z0�-dM� / v x��O(u �_Ngo�:y^�%R
G U I D 0
/ s u b c a t e g o r y
\�eMO�ec�[^�%R-N�vP[^�%R �o�:yc�[KN�|q}�]�w�vP[^�%R
T1z0
�-dM� / v x��O(u �_Ngo�:yP[^�%R G U I D 0
% n
�{�O:
a u d i t p o l / l i s t / u s e r
a u d i t p o l / l i s t / c a t e g o r y / v
a u d i t p o l / l i s t / s u b c a t e g o r y : " D e t a i l e d T r a c k i n g " , " O b j e c t A c c e s s "
� O(u�e_: A u d i t P o l / c l e a r [ / y ]
dk}T�Ng*Rd�@b gO(u��v�k PO(u�=z8h�SGR �͑-�@b gP[^�%R�v�|q}=z8h�SGR �&N\
@b g=z8hx��-��[�p\P(u0
% n
x��
/ ? ��f ( �}
NsSBf) 0
/ y �b6Rnd�@b g=z8h�SGRBf�v�x���c:y0
% n
�{�O:
a u d i t p o l / c l e a r
a u d i t p o l / c l e a r / y
� O(u�e_: A u d i t P o l / r e m o v e [ / u s e r [ : < u s e r n a m e > | < { s i d } > ] ]
[ / a l l u s e r s ]
% n
� P}T�N�S�yd�c�[KN3^6b�v�k PO(u�=z8h�SGR0
% n
x��
/ ? ��f ( �}
NsSBf) 0
/ u s e r c�[��*Rd��k PO(u�=z8h�SGRKNO(u��v S I D bO(u�
T1z
/ a l l u s e r s *Rd�@b gO(u��v�k PO(u�=z8h�SGR0
% n
�{�O:
a u d i t p o l / r e m o v e / u s e r : { S - 1 - 5 - 2 1 - 3 9 7 1 2 3 4 1 7 - 1 2 3 4 5 6 7 }
a u d i t p o l / r e m o v e / a l l u s e r s
� O(u�e_: A u d i t P o l / b a c k u p / f i l e : < f i l e n a m e >
% n
dk}T�N�S\@b gO(u��v�|q}=z8h�SGR-��[��k PO(u�=z8h�SGR-��[�@b g=z8hx���P�N
0R�jHh-N0�P�Ng�[eQ C S V <h_�v�eW[�j0
% n
x��
/ ? ��f ( �}
NsSBf) 0
/ f i l e c�[��(u�O�P�N=z8h�SGRKN�jHh�v
T1z0
% n
�{�O:
a u d i t p o l / b a c k u p / f i l e : c : \ a u d i t p o l i c y . c s v
h O(u�e_: A u d i t P o l / r e s t o r e / f i l e : < f i l e n a m e >
% n
dk}T�N�S\O(u / b a c k u p }T�N�P�NKN@b gO(u��v�|q}=z8h�SGR-��[0�k PO(u�=z8h
�SGR-��[�@b g=z8hx�� ��_�jHh���S0R�|q}0
% n
x��
/ ? ��f ( �}
NsSBf) 0
/ f i l e c�[���_�T P�jHh���S�P�N�v=z8h�SGR0r��jHh�_�/fO(u / b a c k u p
x��@b�^�z �b/fvQ���l�_�&{Tr��jHh<h_0
% n
�{�O:
a u d i t p o l / r e s t o r e / f i l e : c : \ a u d i t p o l i c y . c s v
� O(u�e_: A u d i t P o l / r e s o u r c e S A C L
[ / s e t / t y p e : < r e s o u r c e > [ / s u c c e s s ] [ / f a i l u r e ] / u s e r : < u s e r >
[ / a c c e s s : < a c c e s s f l a g s > ] [ / c o n d i t i o n : < e x p r e s s i o n > ] ]
[ / r e m o v e / t y p e : < r e s o u r c e > / u s e r : < u s e r > [ / t y p e : < r e s o u r c e > ] ]
[ / c l e a r [ / t y p e : < r e s o u r c e > ] ]
[ / v i e w [ / u s e r : < u s e r > ] [ / t y p e : < r e s o u r c e > ] ]
% n
� P}T�Ng-��[hQ�Wir�NX[�S=z8h-��[0 ���_U(u�v�a�vir�NX[�S
P[^�%R ��|q}Mb��"u u�N�N0ˊ8�eQ ' a u d i t p o l / s e t / ? ' �N�S�_s�0}nj
�0
% n
}T�N
/ ? o�:y,g}T�N�v��f0
/ s e t �pc�[�vnj�n^��W �\�e�v��v�e�X�nj�n�|q}X[�S
�c6Rn�U
b�f�evQ-N�v�s g��v0
/ r e m o v e �_nj�n^��Wc�[�vhQ�Wir�NX[�S=z8hn�U-N ��yd�
c�[O(u��v@b g��v0
/ c l e a r �_c�[nj�n^��W�vhQ�Wir�NX[�S=z8hn�U-N�yd�@b g
��v0
/ v i e w R�Qc�[�vnj�n^��W�SO(u��vhQ�Wir�NX[�S=z8h
��v0�`�S�Nx��d'`0Wc�[O(u�0
% n
_xe
% n
/ t y p e �pvQ-��[ir�NX[�S=z8h�vnj�n0
/e�c�v_xe<P�p F i l e � K e y 0ˊ�la ���N<P@SR
'Y\�[0
F i l e : �v��T�jHh0
K e y : {v�_j�x0
/ s u c c e s s c�[b�R=z8h0
/ f a i l u r e c�[1YWe=z8h0
/ u s e r (u�N NvQ-N N.z�e_�Oc�[O(u�:
- D o m a i n N a m e \ A c c o u n t ( �O�Y D O M \ A d m i n i s t r a t o r s )
- S t a n d a l o n e S e r v e r \ G r o u p
- A c c o u n t ( ˊ�S�� L o o k u p A c c o u n t N a m e A P I )
- { S - 1 - x - x - x - x } 0x /f�NAS2�MOh�:y � �te P S I D �_�
�N'Y�b_��bOO0
�O�Y: { S - 1 - 5 - 2 1 - 5 6 2 4 4 8 1 - 1 3 0 2 0 8 9 3 3 - 1 6 4 3 9 4 1 7 4 - 1 0 0 1 }
f�JT: �O(u S I D <h_ �
NgZP�NUO�j�g
�O�x��dk3^6b/f&TX[(W0
/ a c c e s s c�[
kP�n�i ���S�N(u�N NvQ-N N.z�e_�Oc�[:
- !|f
kP��v��^:
�l(uX[�S
kP�:
G A - G E N E R I C A L L
G R - G E N E R I C R E A D
G W - G E N E R I C W R I T E
G X - G E N E R I C E X E C U T E
�jHhX[�S
kP�:
F A - F I L E A L L A C C E S S
F R - F I L E G E N E R I C R E A D
F W - F I L E G E N E R I C W R I T E
F X - F I L E G E N E R I C E X E C U T E
{v�X[�S
kP�:
K A - K E Y A L L A C C E S S
K R - K E Y R E A D
K W - K E Y W R I T E
K X - K E Y E X E C U T E
�O�Y: ' / a c c e s s : F R F W ' g�p���S��[eQ\Omi�O
_U(u=z8h�N�N0
- ASmQ2�MO<P ��Nh�X[�Sn�i ( �O�Y �0 x 1 2 0 0 a 9 ) 0
O(unj�nyr�[MOCQn�iBf �N
N/fl\�e S D D L
j�nBf �ASR g(u0�Y�gz�o �GRO(u�[teX[�S0
/ c o n d i t i o n D��R�Nl\'`�p�Wy�vK��{_ ��O�Y:
D o c u m e n t s e n s i t i v i t y i s H B I ( " H i g h " )
" ( @ R e s o u r c e . S e n s i t i v i t y = = \ " H i g h \ " ) "
% n
�{�O:
% n
a u d i t p o l / r e s o u r c e S A C L / s e t / t y p e : K e y / u s e r : M Y D O M A I N \ m y u s e r / s u c c e s s
a u d i t p o l / r e s o u r c e S A C L / s e t / t y p e : F i l e / u s e r : M Y D O M A I N \ m y u s e r / s u c c e s s
/ f a i l u r e / a c c e s s : F R F W
a u d i t p o l / r e s o u r c e S A C L / s e t / t y p e : F i l e / u s e r : e v e r y o n e / s u c c e s s
/ f a i l u r e / a c c e s s : F R F W / c o n d i t i o n : " ( @ R e s o u r c e . S e n s i t i v i t y = = \ " H i g h \ " ) "
a u d i t p o l / r e s o u r c e S A C L / t y p e : F i l e / c l e a r
a u d i t p o l / r e s o u r c e S A C L / r e m o v e / t y p e : F i l e
/ u s e r : { S - 1 - 5 - 2 1 - 5 6 2 4 8 4 8 1 - 1 3 0 2 0 8 7 9 3 3 - 1 6 4 4 3 9 4 1 7 4 - 1 0 0 1 }
a u d i t p o l / r e s o u r c e S A C L / t y p e : F i l e / v i e w
a u d i t p o l / r e s o u r c e S A C L / t y p e : F i l e / v i e w / u s e r : M Y D O M A I N \ m y u s e r
0 �]ݑ
\ NRO(u�3^6b�[�=z8h�SGR: % n
O(u�3^6b% n
S I D
0 �l g�pr�O(u�3^6b�[�=z8h�SGR0% n
�]�)R�WL�}T�N0% n
, =z8h�SGR�[hQ'`�c�CQ: % % s % n
0 dknj�n^��W�vMR�l ghQ�W S A C L 0% n
� 8�eQ��v: % % l u
nj�n^��W: % % s
O(u�: % % s
�ej: % % s
�h�N: % % s
X[�S
k:
, [ I��c3^6b S I D Bf|v u/���]
!q
b�R
1YWe
b�R�1YWe
4 |v u/��� 0 x % % 0 8 X : % n % % s % n
�4 V S _ V E R S I O N _ I N F O ��
{ aJ
{ aJ? � S t r i n g F i l e I n f o � 0 4 0 4 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n 6 F i l e D e s c r i p t i o n =z8h�SGR z_ n ' F i l e V e r s i o n 1 0 . 0 . 1 9 0 4 1 . 7 2 9 1 ( W i n B u i l d . 1 6 0 1 0 1 . 0 8 0 0 ) 2 I n t e r n a l N a m e a u d i t p o l � . L e g a l C o p y r i g h t � M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . J O r i g i n a l F i l e n a m e A U D I T P O L . E X E . M U I j % P r o d u c t N a m e M i c r o s o f t � W i n d o w s � O p e r a t i n g S y s t e m D P r o d u c t V e r s i o n 1 0 . 0 . 1 9 0 4 1 . 7 2 9 1 D V a r F i l e I n f o $ T r a n s l a t i o n �PADDINGXXPADDING