title: PowerShell AuditQuerySystemPolicy: Value of audit policy
body: <h1>Situation</h1>
  <p>I want the value of an audit policy in Windows, e.g., <code>0cce9240-69ae-11d9-bed3-50505450303</code> → <code>Success</code> or <code>1</code>.
  Hereby, I have to use PowerShell.
  As the <code>auditpol</code> is language dependent, I was looking for a language independent method.
  Thus, I came across <a href="https://stackoverflow.com/questions/46142190/how-to-use-windows-api-auditenumeratecategories-function-in-powershell">this</a> helpful article to use the <code>Win32.Advapi32</code> module.</p>
  <h1>Code</h1>
  <pre><code>$MemberDefinition = @'
  [DllImport(&quot;advapi32.dll&quot;, SetLastError = true)]
      public static extern bool AuditEnumerateCategories(
          out IntPtr ppAuditCategoriesArray, 
          out uint pCountReturned);
  
  [DllImport(&quot;advapi32.dll&quot;, SetLastError = true)]
      public static extern bool AuditLookupCategoryName(
          ref Guid pAuditCategoryGuid, 
          out StringBuilder ppszCategoryName);
  
  [DllImport(&quot;advapi32.dll&quot;, SetLastError = true)]
      public  static extern bool AuditEnumerateSubCategories(
          ref Guid pAuditCategoryGuid, 
          bool bRetrieveAllSubCategories, 
          out IntPtr ppAuditSubCategoriesArray, 
          out uint pCountReturned);
  
  [DllImport(&quot;advapi32.dll&quot;, SetLastError = true)]
      public static extern bool AuditLookupSubCategoryName(
          ref Guid pAuditSubCategoryGuid, 
          out StringBuilder ppszSubCategoryName);
  
  [DllImport(&quot;advapi32.dll&quot;)]
      public static extern void AuditFree(
          IntPtr buffer);
  
  [DllImport(&quot;advapi32.dll&quot;, SetLastError = true)]
      public static extern bool AuditQuerySystemPolicy(
          Guid pSubCategoryGuids, 
          uint PolicyCount, 
          out IntPtr ppAuditPolicy);
  '@
  
  $Advapi32 = Add-Type -MemberDefinition $MemberDefinition -Name 'Advapi32' -Namespace 'Win32' -UsingNamespace System.Text -PassThru
  
  $neBuild = [System.Text.StringBuilder]::new()
  $res1 = [Win32.Advapi32]::AuditLookupSubCategoryName([ref]&quot;0cce9240-69ae-11d9-bed3-505054503030&quot;,[ref]$neBuild)
  Write-Host &quot;$neBuild&quot;
  [IntPtr]$test_out = [IntPtr]::Zero
  $result = [Win32.Advapi32]::AuditQuerySystemPolicy(&quot;0cce9240-69ae-11d9-bed3-505054503030&quot;, 1,[ref]$test_out)
  </code></pre>
  <h1>Problem</h1>
  <p>On the one hand, the output of the <code>Write-Host</code> statement is <code>Kerberos Service Ticket Operations</code> and, therefore, I'm assuming that the general import is working.
  On the other hand, <code>$test_out</code> is always 0, no matter to which value I configure the <code>Kerberos Service Ticket Operations</code>.</p>
  <h1>Question</h1>
  <p>Did I do anything wrong here?
  Is the import, e.g. <code>public static extern bool AuditQuerySystemPolicy</code>,  flawed?
  Do I have to initialize the passed parameters differently?</p>
  <p>Thank you for any help!</p>