Windows audit policy with auditpol: reading subcategories, enforcing them, and sizing the security log

Goal

Read the advanced audit policy currently in effect on a Windows Server host, understand why setting it can silently have no effect, and size the Security log so audited events are not dropped.

Prerequisites

An elevated administrator session; auditpol.exe (built in to Windows Server 2016 and later). Subcategory names are localized on non-English installations; the GUIDs from auditpol /list /subcategory:* /v work on every language.

Steps

1. Dump the full effective policy: auditpol /get /category:*. auditpol's /get sub-command "displays the current audit policy," and /category:* requests every category rather than one.
2. Focus on one area, e.g. account logon: auditpol /get /subcategory:"Logon". The /get reference documents /category and /subcategory as alternative ways to scope the query.
3. Check which layer wins. The security option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" (registry value SCENoApplyLegacyAuditPolicy under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, 1 = enabled) makes subcategory settings win; Microsoft lists its effective default as Enabled on stand-alone servers, member servers and domain controllers. If a GPO has disabled it, category-level (basic) audit policy from Group Policy or Local Security Policy is applied over subcategory settings, and a subcategory set with auditpol /set may be overwritten. Do not configure basic and advanced audit policy for the same host.
4. Set a subcategory: auditpol /set /subcategory:"Logon" /success:enable /failure:enable.
5. Confirm the change took effect: re-run auditpol /get /subcategory:"Logon" and check for a real logon success/failure a moment later.
6. Size the Security log so a burst of audited events does not overwrite history before it is collected: Limit-EventLog -LogName Security -MaximumSize 200MB -OverflowAction OverwriteAsNeeded in Windows PowerShell 5.1, using the cmdlet documented to set "the maximum size of a classic event log" (the value must be divisible by 64 KB). The EventLog cmdlets are not in PowerShell 7; wevtutil sl Security /ms:209715200 does the same there. OverwriteAsNeeded still drops the oldest events when the log is full, so forward events to a collector if history matters.

Expected result

auditpol /get /category:* output matches what was configured, subcategory settings are honored (confirmed by generating a real matching event), and the Security log's size is set explicitly rather than left at its installation default.

Limits and test basis

On a domain-joined host, Group Policy-sourced audit settings normally win over a local auditpol /set, reapplying on the next policy refresh — verify at the GPO if a local change does not stick. To back up current policy before changing it, use auditpol /backup /file:auditpolicy-before.csv, and restore it with auditpol /restore /file:auditpolicy-before.csv. None of these steps requires a reboot.