Windows Server / Services, IIS & Secure Operations
Check effective audit policy before relying on a missing event
An absent Security event can reflect policy or retention rather than proof that an action never occurred. Inspect the effective audit configuration.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
auditpol /get /category:*Read the result
In an authorized Windows terminal, this reports audit subcategory settings using localized names. It does not retroactively generate events that were never recorded.
Resolve and verify
Compare the relevant subcategory, advanced policy and log retention with the investigation's needs. Make approved policy corrections and validate a controlled future event.
Before changing production
Do not enable all audit categories indiscriminately or claim a clean history from an unconfigured log.