如何删除注册表审核规则？

Question

我正在尝试删除我之前设置的注册表审核规则，但它不起作用，我不知道我错了什么。missing/doing。

在注册表项上设置审核规则效果很好：

$RegistryKey = 'HKCU:\Control Panel\Desktop'
$AuditIdentityReference = "Everyone"
$AuditRegistryRights = "SetValue,Delete"
$AuditInheritanceFlags = "ContainerInherit,ObjectInherit"
$AuditPropagationFlags = "None"
$AuditFlags = "success"
$AuditRule = New-Object System.Security.AccessControl.RegistryAuditRule ($AuditIdentityReference,$AuditRegistryRights,$AuditInheritanceFlags,$AuditPropagationFlags,$AuditFlags)
$ACL = Get-Acl $RegistryKey
$ACL.AddAuditRule($AuditRule)
$ACL | Set-Acl -Path $RegistryKey
Get-Acl $RegistryKey -Audit | Select Path -ExpandProperty Audit | fl *

我的理解是我需要构建我希望删除的 $Rule，然后使用 .RemoveAuditRule($Rule)。但是虽然方法returns'true'，但是审核规则还是有的：

$RegistryKey = 'HKCU\Control Panel\Desktop'
$AuditIdentityReference = "Everyone"
$AuditRegistryRights = "SetValue,Delete"
$AuditInheritanceFlags = "ContainerInherit,ObjectInherit"
$AuditPropagationFlags = "None"
$AuditFlags = "success"
$AuditRule = New-Object System.Security.AccessControl.RegistryAuditRule ($AuditIdentityReference,$AuditRegistryRights,$AuditInheritanceFlags,$AuditPropagationFlags,$AuditFlags)
$ACL = Get-Acl $RegistryKey
$ACL.RemoveAuditRule($AuditRule)
$ACL | Set-Acl -Path $RegistryKey
Get-Acl $RegistryKey -Audit | Select Path -ExpandProperty Audit | fl *

在文件系统上做类似的事情虽然工作正常：

$Dir = 'C:\Testing'
$ACL = get-acl $Dir
$Rule = new-object System.Security.AccessControl.FileSystemAuditRule("Everyone","CreateDirectories,CreateFiles,Delete,DeleteSubdirectoriesAndFiles,Write,WriteData","ContainerInherit,ObjectInherit","None","Success,Failure")
$ACL.AddAuditRule($Rule)
$ACL | Set-Acl -Path $Dir
$ACL.RemoveAuditRule($Rule)
$ACL | Set-Acl -Path $Dir

Answer 1

获取 ACL 时没有包含 SACL，因此没有要删除的内容。

改变这个：

$ACL = Get-Acl $RegistryKey
$ACL.RemoveAuditRule($AuditRule)
$ACL | Set-Acl -Path $RegistryKey

进入这个：

$ACL = Get-Acl $RegistryKey <b>-Audit</b>
$ACL.RemoveAuditRule($AuditRule)
$ACL |设置 Acl -Path $RegistryKey

问题就会消失。

如何删除注册表审核规则？

How to Remove Registry Audit Rules?

powershell

registry

acl