Merge pull request #41 from jvheaton/Update-AuditPolicy-Subcategories

Update audit policy subcategories
ticketmaster · Jan 6, 2017 · 8b698a5 · 8b698a5
2 parents 89c35d4 + 90dd157
commit 8b698a5
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Public/AuditPolicy.ps1 b/Public/AuditPolicy.ps1
@@ -53,6 +53,8 @@ function AuditPolicy {
             "Special Logon",
             "Other Logon/Logoff Events",
             "Network Policy Server",
+            "User / Device Claims",
+            "Group Membership",
             "File System",
             "Registry",
             "Kernel Object",
@@ -65,12 +67,16 @@ function AuditPolicy {
             "Filtering Platform Connection",
             "Other Object Access Events",
             "Detailed File Share",
+            "Removable Storage",
+            "Central Policy Staging",
             "Sensitive Privilege Use",
             "Non Sensitive Privilege Use",
             "Other Privilege Use Events",
             "Process Termination",
             "DPAPI Activity",
             "RPC Events",
+            "Plug and Play Events",
+            "Token Right Adjusted Events",
             "Process Creation",
             "Audit Policy Change",
             "Authentication Policy Change",