Hi,
I am trying to find the permission "Manage Auditing and Security Log". I want to find out this for remote computers.
I have written a code using Get-WMIObject RSOP_UserPrivilegeRight
Main line of code is $Output = Get-WMIObject RSOP_UserPrivilegeRight -namespace root\rsop\computer -ComputerName $computer | Where {$_.UserRight -eq $URName -and $_.precedence -eq 1} | select -property PSComputername, @{Name=’AccountList’;Expression={[string]::join(“;”, ($_.AccountList))}}
However, it seems some bug or Get-Wmiobject does not successfully retrieve this permission details from Windows 2012.
Somehow, some other permission like shutdown computer and all can be returned by WMI query, but Auditing permission is not returned by WMI query.
i have seen some other forums and someone says it needs custom code and WMI is not solution for it.
Please help if any clue you have.