ÇÔ¸Õãªé'¹âºÒ¡ÅØèÁ'à¾×èÍ¡Ó˹´¤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ·ÕèÃÒÂÅÐàÍÕ´㹡ÒõÃǨÊͺ¡ÒõÑ駤èÒÊÓËÃѺãªé§Ò¹ Windows Vista áÅÐ Windows Server 2008 º¹¤ÍÁ¾ÔÇàµÍÃì ã¹â´àÁ¹ Windows Server 2008 ã¹â´àÁ¹ Windows Server 2003 ËÃ×Í ã¹â´àÁ¹ Windows 2000

º·¤ÇÒÁ¹Õé͸ԺÒ¶֧ÇÔ¸Õ¡ÒÃãªé'¹âºÒ¡ÅØèÁ'à¾×èÍ¡Ó˹´¤èÒ¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑÂÃÒÂÅÐàÍÕ´¡ÒõÑ駤èÒ·ÕèµÃǨÊͺÊÓËÃѺ¤ÍÁ¾ÔÇàµÍÃì·Õèãªé Windows Vista ËÃ×Í Windows Server 2008 ã¹â´àÁ¹ Windows Server 2003 ËÃ×Í ã¹â´àÁ¹ Windows 2000 ã¹ Windows Vista áÅÐ Windows Server 2008 ¤Ø³ÊÒÁÒöà¾ÔèÁàµÔÁ¤Çº¤ØÁ»ÃÐàÀ·ÂèÍ¢ͧ¹âºÒ¡ÒõÃǨÊͺáµèÅÐà¡Ô¹¡ÇèÒ·Õè¤Ø³ÁÕÃкº»¯ÔºÑµÔ¡Òà Windows ÃØ蹡è͹˹éÒ ºØ¤¤Åà»ç¹¡ÒõÃǨÊͺ¹âºÒ»ÃÐàÀ·ÂèÍ·Õè¾ÃéÍÁãªé§Ò¹ã¹ Windows Vista ¨ÐäÁèÁÕ¡ÒÃà»Ô´à¼Âã¹ÍÔ¹à·ÍÃìà¿«¢Í§à¤Ã×èͧÁ×Í'¹âºÒ¡ÅØèÁ' ¼Ùé´ÙáÅÃкºÊÒÁÒöãªé¢Ñ鹵͹·Õè͸ԺÒÂäÇé㹺·¤ÇÒÁ¹Õéà¾×èÍ»ÃѺãªé¹âºÒ¡ÒõÃǨÊͺẺ¡Ó˹´àͧ·Õèãªé¡ÒÃÃÑ¡ÉÒ¤ÇÒÁ»ÅÍ´ÀÑ·ÕèÃÒÂÅÐàÍÕ´㹡ÒõÃǨÊͺ¡ÒõÑ駤èÒ¡ÒÃãªé§Ò¹ Windows Vista áÅÐ Windows Server 2008 º¹¤ÍÁ¾ÔÇàµÍÃì ã¹â´àÁ¹ Windows Server 2003 ËÃ×Í ã¹â´àÁ¹ Windows 2000

ÊÔ觷Õè¤ÇþԨÒóÒ

µèÍ仹Õé¤×Í ºÒ§ÊÔ觷Õè¤ÇþԨÒóҡè͹·Õè¤Ø³·ÓµÒÁ¢Ñ鹵͹·Õè¡ÅèÒǶ֧㹺·¤ÇÒÁ¹Õé:

• ÇÔ¸Õ¡ÒÃãªéâ¤é´µÑÇÍÂèÒ§ µÑÇÍÂèÒ§ÃËÑÊãªé Netlogon ãªéÃèÇÁ¡Ñ¹ ¹Í¡¨Ò¡¹Õé µÑÇÍÂèÒ§ÃËÑÊãªéâ¿Åà´ÍÃì %SystemRoot%\Temp à»ç¹á¤ª
• ¡Ãкǹ§Ò¹ãªéâ´àÁ¹µÑÇÍÂèÒ§¢Í§ Contoso.com
• ¡Ãкǹ¡ÒùÕéÊѹ¹ÔÉ°Ò¹ÇèÒ à§×è͹䢵èÍ仹Õéà»ç¹¨ÃÔ§:
  • ¤Ø³äÁè¤Øé¹à¤Â¡Ñºà·¤â¹âÅÂÕáÅÐà¤Ã×èͧÁ×͵èÍ仹Õé:
    • Group Policy startup scripts
    • Group Policy Management Console
    • The Auditpol.exe command-line tool
  • You have a basic understanding of batch file processing.
• You are familiar with the scripts that the procedure uses work to override legacy domain-based audit policy settings with the detailed audit policy settings that are available in Windows Vista. If you do not want to configure the detailed audit policy settings that are available in Windows Vista, do not use the procedure that this article discusses.
• A legacy policy overwrites the auditpol settings only if the auditpol settings are defined explicitly in the legacy policy. ÅѡɳСÒ÷ӧҹ¹Õéà¡Ô´¨Ò¡¡ÒÃÍ͡Ẻ Additionally, if the auditpol settings are specified as “No auditing” or as “not defined,” the auditpol settings have precedence and are not overwritten by the legacy policy.

Use Group Policy to configure detailed security auditing settings for computers

To use Group Policy to configure detailed security auditing settings for Windows Vista-based or Windows Server 2008-based computers in a Windows Server 2003 domain or in a Windows 2000 domain, follow these steps.

Step 1: Determine the security auditing settings that you want to deploy to Windows Vista-based or Windows Server 2008-based computers

1. Log on to a computer as a user who has administrator credentials.
2. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁ·Ñé§ËÁ´¤ÅÔ¡àÊÃÔÁ¤ÅÔ¡¢ÇÒ¾ÃéÍÁÃѺ¤ÓÊÑè§áÅéÇ ¤ÅÔ¡àÃÕ¡ãªé㹰ҹмÙé´ÙáÅ.
3. 㹡ÒáÒäǺ¤ØÁºÑ­ªÕ¼Ùéãªé¡ÅèͧâµéµÍº ¤ÅÔ¡´Óà¹Ô¹¡ÒõèÍ.
4. Flush the default audit policy settings. To do this, type the following line at the command prompt, and then press ENTER:
   auditpol /clear
5. Use the Auditpol.exe command-line tool to configure the custom audit policy settings that you want.
   
   For example, type the following lines at the command prompt. Press ENTER after each line.
   auditpol /set /subcategory:"user account management" /success:enable /failure:enable
   auditpol /set /subcategory:"logon" /success:enable /failure:enable
   auditpol /set /subcategory:"IPSEC Main Mode" /failure:enable
   ËÁÒÂà˵Ø:To see all possible categories and subcategories, type the following line at the command prompt, and then press ENTER:
   auditpol /list /subcategory:*
6. Type the following line at the command prompt, and then press ENTER:
   auditpol /backup /file:auditpolicy.txt
7. Copy the Auditpolicy.txt file to the Netlogon share of the domain controller that holds the primary domain controller (PDC) emulator role in the domain.
   
   The Auditpolicy.txt file contains all the audit policy settings that you configured. The startup script uses this file to reapply the policy. After you successfully apply the startup script one time, you do not have to restart the computer to update audit policy settings. To update audit policy settings, overwrite the earlier version of the Auditpolicy.txt file that you copied to the Netlogon share. To do this, create a new Auditpolicy.txt file, and then copy the new Auditpolicy.txt file to the Netlogon share.

Step 2: Create the scripts, and then add the scripts to the Netlogon share

Microsoft áÊ´§µÑÇÍÂèÒ§¡ÒÃà¢Õ¹â»Ãá¡ÃÁà¾×èÍ»ÃСͺ¡ÒÃ͸ԺÒÂà·èÒ¹Ñé¹ áÅÐäÁèÁÕ¡ÒÃÃѺ»ÃСѹ äÁèÇèÒâ´ÂªÑ´á¨é§ËÃ×Íâ´Â¹Ñ ·Ñ駹ÕéÃÇÁ¶Ö§ áµèäÁè¨Ó¡Ñ´à¾Õ§¡ÒÃÃѺ»ÃСѹâ´Â¹ÑÂã¹àÃ×èͧ¡Òë×éÍ¢ÒÂËÃ×ͤÇÒÁàËÁÒÐÊÁÊÓËÃѺÇѵ¶Ø»ÃÐʧ¤ì੾ÒÐ º·¤ÇÒÁ¹Õé͹ØÁÒ¹ÇèҤسÁÕ¤ÇÒÁ¤Øé¹à¤Â¡ÑºÀÒÉÒ¡ÒÃà¢Õ¹â»Ãá¡ÃÁ·ÕèáÊ´§ÍÂÙè ÃÇÁ·Ñé§à¤Ã×èͧÁ×͵èÒ§æ ·Õèãªé㹡ÒÃÊÃéÒ§áÅÐá¡é¨Ø´º¡¾Ãèͧ¡Ãкǹ¡Òà ÇÔÈǡýèÒÂʹѺʹع¢Í§ Microsoft ÊÒÁÒöªèÇÂ͸ԺÒÂà¡ÕèÂǡѺ˹éÒ·Õè¡ÒÃãªé§Ò¹¢Í§¡Ãкǹ¡ÒÃ੾ÒÐä´é áµè¨ÐäÁè»ÃѺà»ÅÕè¹µÑÇÍÂèÒ§àËÅèÒ¹Õéà¾×èÍãËéÁÕ˹éÒ·Õè¡ÒÃãªé§Ò¹·Õèà¾ÔèÁ¢Öé¹ ËÃ×ÍÊÃéÒ§¡Ãкǹ¡ÒÃã´æ à¾×è͵ͺʹͧ¤ÇÒÁµéͧ¡ÒÃÍÂèÒ§ã´ÍÂèҧ˹Ö觢ͧ¤Ø³â´Â੾ÒÐ

1. Create the AuditPolicy.cmd script. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::
   1. àÃÔèÁãªé§Ò¹ Notepad áÅéǨ֧à»Ô´àÍ¡ÊÒÃÇèÒ§
   2. Paste the following code to the document in Notepad:

      @echo off
      
      REM AuditPolicy.cmd
      REM (c) 2006 Microsoft Corporation.  All rights reserved.
      REM Sample Audit Script to deploy Windows Vista
      REM Granular Audit Policy settings.
      
      REM Should be run as a startup script from Group Policy
      
      REM ###################################################
      REM Declare Variables so that we only need to edit file
      REM names/paths in one location in script
      REM ###################################################
      
      set AuditPolicyLog=%systemroot%\temp\auditpolicy.log
      set OSVersionSwap=%systemroot%\temp\osversionwap.txt
      set OsVersionTxt=%systemroot%\temp\osversion.txt
      set MachineDomainTxt=%systemroot%\temp\machinedomain.txt
      set MachineDomainSwap=%systemroot%\temp\machinedomainSwap.txt
      set ApplyAuditPolicyCMD=applyauditpolicy.cmd
      set AuditPolicyTxt=auditpolicy.txt
      
      REM ###################################################
      REM Clear Log & start fresh
      REM ###################################################
      
      if exist %AuditPolicyLog% del %AuditPolicyLog% /q /f
      date /t > %AuditPolicyLog% & time /t >> %AuditPolicyLog%
      echo.
      
      REM ###################################################
      REM Check OS Version
      REM ###################################################
      
      ver | findstr "[" > %OSVersionSwap%
      for /f "tokens=2 delims=[" %%i in (%OSVersionSwap%) do echo %%i > %OsVersionTxt%
      for /f "tokens=2 delims=] " %%i in (%OsVersionTxt%) do set osversion=%%i
      echo OS Version=%osversion% >> %AuditPolicyLog%
      
      REM ###################################################
      REM Skip Pre-Vista
      REM ###################################################
      
      if "%osversion%" LSS "6.0" exit /b 1
      
      REM ###################################################
      REM Get Domain Name
      REM ###################################################
      
      WMIC /namespace:\\root\cimv2 path Win32_ComputerSystem get domain /format:list > %MachineDomainSwap%
      find /i "Domain=" %MachineDomainSwap% > %MachineDomainTxt%
      for /f "Tokens=2 Delims==" %%i in (%MachineDomainTxt%) do set machinedomain=%%i
      echo Machine domain=%machinedomain% >> %AuditPolicyLog%
      
      REM ###################################################
      REM Copy Script & Policy to Local Directory or Terminate
      REM ###################################################
      
      xcopy \\%machinedomain%\netlogon\%ApplyAuditPolicyCMD% %systemroot%\temp\*.* /r /h /v /y
      if %ERRORLEVEL% NEQ 0 (
          echo Could not read \\%machinedomain%\netlogon\%ApplyAuditPolicyCMD% >> %AuditPolicyLog%
          exit /b 1
      ) else (
          echo Copied \\%machinedomain%\netlogon\%ApplyAuditPolicyCMD% to %systemroot%\temp >> %AuditPolicyLog%
      )
      
      xcopy \\%machinedomain%\netlogon\%AuditPolicyTxt% %systemroot%\temp\*.* /r /h /v /y
      if %ERRORLEVEL% NEQ 0 (
          echo Could not read \\%machinedomain%\netlogon\%AuditPolicyTxt% >> %AuditPolicyLog%
          exit /b 1
      ) else (
          echo Copied \\%machinedomain%\netlogon\%AuditPolicyTxt% to %systemroot%\temp >> %AuditPolicyLog%
      )
      
      REM ###################################################
      REM Create Named Scheduled Task to Apply Policy
      REM ###################################################
      
      %systemroot%\system32\schtasks.exe /create /ru System /tn audit /sc hourly /mo 1 /f /rl highest /tr "%systemroot%\temp\%ApplyAuditPolicyCMD%"
      if %ERRORLEVEL% NEQ 0 (
          echo Failed to create scheduled task for Audit >> %AuditPolicyLog%
          exit /b 1
      ) else (
          echo Created scheduled task for Audit >> %AuditPolicyLog%
      )
      
      REM ###################################################
      REM Start Named Scheduled Task to Apply Policy
      REM ###################################################
      
      %systemroot%\system32\schtasks.exe /run /tn audit
      if %ERRORLEVEL% NEQ 0 (
          Failed to execute scheduled task for Audit >> %AuditPolicyLog%
      ) else (
          echo Executed scheduled task for Audit >> %AuditPolicyLog%
      )

   3. 㹡ÒÃá¿éÁ:àÁ¹Ù ¤ÅÔ¡ºÑ¹·Ö¡.
   4. 㹡Òúѹ·Ö¡à»ç¹ª¹Ô´¡Åèͧ ¤ÅÔ¡á¿éÁ·Ñé§ËÁ´»ÃÐàÀ·:AuditPolicy.cmd㹡Òê×èÍá¿éÁ¡Åèͧ áÅéǤÅÔ¡ºÑ¹·Ö¡.
2. Create the ApplyAuditPolicy.cmd script. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::
   1. àÃÔèÁãªé§Ò¹ Notepad áÅéǨ֧à»Ô´àÍ¡ÊÒÃÇèÒ§
   2. Paste the following code to the document in Notepad:

      @echo off
      
      REM ApplyAuditPolicy.cmd
      REM (c) 2006 Microsoft Corporation.  All rights reserved.
      REM Sample Audit Script to deploy Windows Vista
      REM Granular Audit Policy settings.
      
      
      REM ###################################################
      REM Declare Variables so that we only need to edit file
      REM names/paths in one location in script
      REM ###################################################
      
      set DeleteAudit=DeleteAudit.txt
      set AuditPolicyLog=%systemroot%\temp\AuditPolicy.log
      set ApplyAuditPolicyLog=%systemroot%\temp\ApplyAuditPolicy.log
      set OSVersionSwap=%systemroot%\temp\osversionwap.txt
      set OsVersionTxt=%systemroot%\temp\osversion.txt
      set MachineDomainTxt=%systemroot%\temp\machinedomain.txt
      set MachineDomainSwap=%systemroot%\temp\machinedomainSwap.txt
      set ApplyAuditPolicyCMD=ApplyAuditpolicy.cmd
      set AuditPolicyTxt=AuditPolicy.txt
      
      REM ###################################################
      REM Clear Log & start fresh
      REM ###################################################
      
      if exist %ApplyAuditPolicyLog% del %ApplyAuditPolicyLog% /q /f
      date /t > %ApplyAuditPolicyLog% & time /t >> %ApplyAuditPolicyLog%
      echo.
      
      REM ###################################################
      REM Check OS Version
      REM ###################################################
      
      ver | findstr "[" > %OSVersionSwap%
      for /f "tokens=2 delims=[" %%i in (%OSVersionSwap%) do echo %%i > %OsVersionTxt%
      for /f "tokens=2 delims=] " %%i in (%OsVersionTxt%) do set osversion=%%i
      echo OS Version=%osversion% >> %ApplyAuditPolicyLog%
      
      REM ###################################################
      REM Skip Pre-Vista
      REM ###################################################
      
      if "%osversion%" LSS "6.0" exit /b 1
      
      REM ###################################################
      REM Get Domain Name
      REM ###################################################
      
      WMIC /namespace:\\root\cimv2 path Win32_ComputerSystem get domain /format:list > %MachineDomainSwap%
      find /i "Domain=" %MachineDomainSwap% > %MachineDomainTxt%
      for /f "Tokens=2 Delims==" %%i in (%MachineDomainTxt%) do set machinedomain=%%i
      echo Machine domain=%machinedomain% >> %ApplyAuditPolicyLog%
      
      REM ###################################################
      REM Delete Audit Task
      REM Should only be used to remove the pseudo-policy from
      REM client machines (designed for future Vista revisions
      REM where this script will no longer be necessary, and this
      REM script needs to be backed out).
      
      REM to use, simply create a file in NETLOGON with a name
      REM that matches the contents of DeleteAudit variable (above)
      REM ###################################################
      
      if exist \\%machinedomain%\netlogon\%DeleteAudit% (
          %systemroot%\system32\schtasks.exe /delete /tn "Audit" /F
          DEL %AuditPolicyLog%
          DEL %ApplyAuditPolicyLog%
          DEL %OSVersionSwap%
          DEL %OsVersionTxt%
          DEL %MachineDomainTxt%
          DEL %MachineDomainSwap%
          DEL %systemroot%\temp\%ApplyAuditPolicyCMD%
          DEL %systemroot%\temp\%AuditPolicyTxt%
          exit /b 1
      ) 
      
      REM ###################################################
      REM Copy Audit Policy to Local Directory
      REM This is tolerant of failures since the copy is just
      REM a "cache refresh".
      REM ###################################################
      
      xcopy \\%machinedomain%\netlogon\%AuditPolicyTxt% %systemroot%\temp\*.* /r /h /v /y
      if %ERRORLEVEL% NEQ 0 (
          echo Could not read \\%machinedomain%\netlogon\%AuditPolicyTxt% so using previous cached copy>> %ApplyAuditPolicyLog%
      ) else (
          echo Copied \\%machinedomain%\netlogon\%AuditPolicyTxt% to %systemroot%\temp >> %ApplyAuditPolicyLog%
      )
      
      REM ###################################################
      REM Apply Policy
      REM ###################################################
      
      %systemroot%\system32\auditpol.exe /restore /file:%systemroot%\temp\%AuditPolicyTxt%
      if %ERRORLEVEL% NEQ 0 (
          Failed to apply audit settings >> %ApplyAuditPolicyLog%
      ) else (
          echo Successfully applied audit settings >> %ApplyAuditPolicyLog%
      )

   3. 㹡ÒÃá¿éÁ:àÁ¹Ù ¤ÅÔ¡ºÑ¹·Ö¡.
   4. 㹡Òúѹ·Ö¡à»ç¹ª¹Ô´¡Åèͧ ¤ÅÔ¡á¿éÁ·Ñé§ËÁ´»ÃÐàÀ·:ApplyAuditPolicy.cmd㹡Òê×èÍá¿éÁ¡Åèͧ áÅéǤÅÔ¡ºÑ¹·Ö¡.
3. Copy the AuditPolicy.cmd script and the ApplyAuditPolicy.cmd script to the Netlogon share of the domain controller that holds the PDC emulator role in the domain.
4. Wait until Active Directory replication occurs. Also, wait until the files and folders in the system volume (SYSVOL) shared folder replicate on domain controllers in the domain.
5. Add the startup script to the Default Domain Policy. â´ÂãËé·ÓµÒÁ¢Ñ鹵͹µèÍ仹Õé::
   1. àÃÔèÁãªéà¤Ã×èͧÁ×Í·Õè¼Ùéãªé¢Í§ä´àá·ÍÃÕ·Õèãªé§Ò¹ÍÂÙèáÅФÍÁ¾ÔÇàµÍÃì
   2. ¤ÅÔ¡¢ÇÒDomainNameáÅéÇ ¤ÅÔ¡¤Ø³ÊÁºÑµÔ.
   3. ¤ÅÔ¡¡ÒùâºÒ¡ÅØèÁá·çº ¤ÅÔ¡¹âºÒÂâ´àÁ¹àÃÔèÁµé¹áÅéÇ ¤ÅÔ¡á¡éä¢. The Group Policy Object Editor tool starts.
   4. ¢ÂÒ¡ÒáÓ˹´¤èÒ¤ÍÁ¾ÔÇàµÍÃì¢ÂÒ¡ÒõÑ駤èÒ windowsáÅéÇ ¤ÅԡʤÃÔ»µì (/ »Ô´à¤Ã×èͧÊÓËÃѺ¡ÒÃàÃÔèÁµé¹).
   5. ¤ÅÔ¡Êͧ¤ÃÑé§àÃÔèÁµé¹áÅéÇ ¤ÅÔ¡add.
   6. 㹡Òê×èÍʤÃÔ»µìbox, type the universal naming convention (UNC) path of the AuditPolicy.cmd file that is located in the Netlogon share. Use the following format:
      \\FullyQualifiedDomainName\Netlogon\AuditPolicy.cmd
      µÑÇÍÂèÒ§àªè¹ ¾ÔÁ¾ì\\contoso.com\netlogon\auditpolicy.cmd.
   7. ¤ÅÔ¡µ¡Å§Êͧ¤ÃÑé§

Step 3: Verify that the security auditing settings are successfully applied

1. Wait until Active Directory replication occurs. Also, wait until the files and folders in the system volume (SYSVOL) shared folder replicate on domain controllers in the domain.
2. Restart a computer that is joined to the domain. Then, log on to the computer as a user who has administrator credentials.
3. ¤ÅÔ¡àÃÔèÁ¡Ò÷ӧҹªÕéä»·Õèâ»Ãá¡ÃÁ·Ñé§ËÁ´áÅéÇ ¤ÅÔ¡àÊÃÔÁ.
4. ¤ÅÔ¡¢ÇÒ¾ÃéÍÁÃѺ¤ÓÊÑè§áÅéÇ ¤ÅÔ¡àÃÕ¡ãªé㹰ҹмÙé´ÙáÅ.
5. 㹡ÒáÒäǺ¤ØÁºÑ­ªÕ¼Ùéãªé¡ÅèͧâµéµÍº ¤ÅÔ¡´Óà¹Ô¹¡ÒõèÍ.
6. ¾ÔÁ¾ìºÃ÷ѴµèÍ仹Õé·Õè¾ÃéÍÁ·ìÃѺ¤ÓÊÑè§ áÅС´ enter:
   auditpol /get /category: *
7. µÃǨÊͺÇèÒ µÑ駤èÒ¡ÒõÃǨÊͺ¤ÇÒÁ»ÅÍ´ÀÑ·ÕèáÊ´§¾ÃÍÁµì¤ÓÊÑ觵ç¡Ñº¡ÒõÑ駤èÒ·Õè¡Ó˹´¤èÒäÇéã¹á¿éÁ AuditPolicy.txt ·Õè¤Ø³ÊÃéÒ§äÇéã¹ "¢Ñ鹵͹·Õè 1: ¡Ó˹´¤ÇÒÁ»ÅÍ´ÀÑÂãËé¡Ñº¡ÒõÃǨÊͺ¡ÒõÑ駤èÒ·Õè¤Ø³µéͧ¡ÒûÃѺãªé Windows ·Õèãªé Vista ËÃ×Í Windows Server 2008 º¹¤ÍÁ¾ÔÇàµÍÃì "
   
   ¶éÒÁÕ¡ÒõÑ駤èÒ¡ÒõÃǨÊͺ¤ÇÒÁ»ÅÍ´ÀÑÂäÁèµÃ§¡Ñº µÃǨÊͺá¿éÁºÑ¹·Ö¡·ÕèÊÃéÒ§¢Öé¹ â´ÂãªéʤÃÔ»µì¡ÒÃàÃÔèÁµé¹ã¹â¿Åà´ÍÃì %SystemRoot%\Temp ¶éÒäÁèÁÕá¿éÁºÑ¹·Ö¡·ÕèÁÕÍÂÙèã¹â¿Åà´ÍÃì %SystemRoot%\Temp µÃǨÊͺ¤ÍÁ¾ÔÇàµÍÃìà¾×èÍ´ÙÇèÒà˵Øã´'¹âºÒ¡ÅØèÁ'äÁèãªé

ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺÇÔ¸Õ¡ÒáÓ˹´¤èÒàÃÔèÁµé¹ãªé§Ò¹Ê¤ÃÔ»µìã¹ Active Directory áÇÐä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft:ÊÓËÃѺ¢éÍÁÙÅà¾ÔèÁàµÔÁà¡ÕèÂǡѺ¤Í¹â«Å¡ÒèѴ¡ÒùâºÒ¡ÅØèÁ áÇÐä»·ÕèàÇçºä«µìµèÍ仹Õé¢Í§ Microsoft:For more information about the Auditpol.exe command-line tool and the Schtasks.exe command-line tool, see Windows Vista Help and Support.