title: Powershell to get an OU's ACL-Security Auditing policy and its enabled entries
body: <p>I am trying to get a report out of Powershell and AD that will show me the list of items on this property page from Active Directory –</p>
  <p>From ADUC, right click your Root Domain OU -&gt; properties-&gt;Security tab-&gt;Advanced-&gt;Auditing-&gt; Select/Open one of the auditing entries. It will look Something like this:</p>
  <p><a href="https://i.stack.imgur.com/QCQAg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QCQAg.png" alt="enter image description here" /></a></p>
  <p>On that page you will see the Principal, Type, and Applies To fields at the top and on the bottom section, the Permissions and Properties being audited, checked or unchecked.</p>
  <p>I want to list those items and their values via Powershell.</p>
  <p>I get to that Auditing page by doing this:</p>
  <pre><code>
   AD:\&gt; $acl = get-acl 'DC=domain,DC=company,DC=com' -Audit
  
   AD:\&gt; $acl.Audit
  </code></pre>
  <p>Then single out one of the entries:</p>
  <pre><code>AD:\&gt; $acl.Audit[0]
  
  ActiveDirectoryRights : GenericAll
  InheritanceType       : All
  ObjectType            : 00000000-0000-0000-0000-000000000000
  InheritedObjectType   : 00000000-0000-0000-0000-000000000000
  ObjectFlags           : None
  AuditFlags            : Success, Failure
  IdentityReference     : Everyone
  IsInherited           : False
  InheritanceFlags      : ContainerInherit
  PropagationFlags      : None
  </code></pre>
  <p>But that’s as far as I can get being a n00b. The only thing Ive been able to extract out of that list is the value itself and im not even sure which item if any of these <em>might</em> contain the items/values I want. Am I even in the right place?</p>
  <p>Thanks in advance,</p>
  <p>Richard</p>