Returns resultant set of policy Security Audit Policy information. This script contributed by Mike Stephens of Microsoft.

Visual Basic
Edit|Remove
Const FL_FORCE_CREATE_NAMESPACE = 4

strComputer = "."


Set locator = CreateObject("WbemScripting.SWbemLocator")
Set connection = locator.ConnectServer( strComputer, "root\rsop", null, null, null, null, 0, null)
Set provider = connection.Get("RsopLoggingModeProvider")
provider.RsopCreateSession FL_FORCE_CREATE_NAMESPACE, Null, namespaceLocation, hResult, eInfo

Set rsopProv = locator.ConnectServer _
    (strComputer, namespaceLocation & "\Computer", null, null, Null, Null, 0 , Null)

WScript.Echo "Security Audit Policy Settings"

Set colItems = rsopProv.ExecQuery("Select * from RSOP_AuditPolicy")

For Each objItem in colItems  
    WScript.Echo String(50, "=")
    Wscript.Echo "Category: " & objItem.Category
    Wscript.Echo "Precedence: " & objItem.Precedence
    Wscript.Echo "Failure: " & objItem.Failure
    Wscript.Echo "Success: " & objItem.Success
Next

provider.RsopDeleteSession namespaceLocation, hResult