[英]Windows command to display advanced audit settings of Registry Keys
Using commands on Windows, I am trying to display the advanced audit settings of Registry Keys. 使用Windows上的命令,我试图显示注册表项的高级审核设置。 I have tried to do this on powershell and cmd with admin privileges but I have had no luck in doing so. 我曾尝试在Powershell和具有管理员权限的cmd上执行此操作,但是这样做并没有运气。 After a load of research and testing I have managed to craft commands to display the registry key permissions using the commands below on powershell and on CMD, I feel like I am very close but I cant seem to find the right parameters. 经过大量的研究和测试,我设法使用以下命令在Powershell和CMD上使用以下命令来显示注册表项权限,我感觉自己非常接近,但似乎找不到正确的参数。
powershell: 电源外壳:
(Get-Acl -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion).AuditToString
command prompt: 命令提示符:
C FOR /F "tokens=3 delims= " %A IN ('reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v "MachineGuid"')`
DO @icacls %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys\76944fb33636aeddb9590521c2e8815a_%A
I tried this: 我尝试了这个:
PS C:\> (get-acl hklm:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -audit).GetAuditRules($true,$true,[System.Security.Principal.NTAccount])
RegistryRights : FullControl
AuditFlags : Success
IdentityReference : fffff\tom
IsInherited : False
InheritanceFlags : ContainerInherit
PropagationFlags : None
Is this what you expect? 这是您所期望的吗?
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.