This command is new to Windows Server 2008 and Vista and is required for querying or configuring audit policy at the subcategory level.  Before using this command to configure subcategories make sure you enable "Audit: Force audit policy subcategory settings (Windows Vista or later) in AD GPO to override audit policy category settings".

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings

By default, if you define a value for a policy in one of the top-level categories—either in the computer's Local Security Policy or in an applicable GPO—then that top-level policy will usually override any configurations that you make at the subcategory level with the auditpol command.

Under Windows’ default behavior, subcategory policies take effect only when you leave the related top-level category undefined in the Local Security Policy and in all applicable GPOs. If a category policy is defined, then all subcategory policies under that policy will be defined.

I stress usually and default behavior because this new Group Policy Object setting "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" reverses that behavior. If you enable this setting, then your subcategory configurations will override how the applied Group Policy sets the top-level policies.

Prior to Win2008 R2, this command is the only way you can configure audit policy at the subcategory level (Pre R2, Group Policy only allows you to configure audit policy at the category level).  

Furthermore auditpol does not accept a computer name for remotely configuring audit policy on another computer on the network; instead you must execute auditpol locally on each system.

With Win2008 R2 you can configure audit subcategories using Group Policy; look under Security Settings\Advanced Audit Policy.

To see the full syntax for this command run "auditpol /?" at the command line.

To get a listing of all categories and their subcategories, run:

auditpol /list /subcategory:*

To display the current audit policy for all subcategories run:

auditpol /get /category:*

Here's an example of enabling the File System subcategory for success and failure:

AUDITPOL /SET /SUBCATEGORY:"file system" /SUCCESS:ENABLE /FAILURE:ENABLE

Recommended Baseline Audit Policy for Windows Server 2008

If you enable too wide an audit policy you will be innundated with "noise" events. I recommend starting with this and tweaking from there. This policy turns off the worst offenders and other categories whose events aren't typically worth much.

Before using this recommendation make sure you review my article on auditpol and its related articles as well!

(Running all these commands at once also makes your hard drive emit a really cool sound pattern,too!)

auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable

auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable

auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable

auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

auditpol /set /subcategory:"Logoff" /success:enable /failure:enable

auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable

auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable

auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable

auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable

auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable

auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

auditpol /set /subcategory:"File System" /success:enable /failure:enable

auditpol /set /subcategory:"Registry" /success:enable /failure:enable

auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable

auditpol /set /subcategory:"SAM" /success:disable /failure:disable

auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable

auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable

auditpol /set /subcategory:"File Share" /success:enable /failure:enable

auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable

auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable

auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable

auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable

auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable

auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable

auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable

auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable

auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable

auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable

auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable

auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable

auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable

auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable

auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable

auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable

auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable

auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable

auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable

auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable

auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable

auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable