How do I enable "Audit user account logons" using PowerShell, to improve security?

Question

With successful hacking attacks more often employing valid Active Directory user credentials, it is quite helpful when administrators can
easily poll user logon events. Rather than query
every domain computer for its logon events, one can alter the Default Domain Controller Policy GPO to enable "Audit user account logons" (Success and Failure) then merely poll
only the domain controller -- quite efficient. PowerShell helpfully has its Group Policy Module, including the following two cmdlets.
1) Get-GPO "Default Domain Controllers Policy" will retrieve the top-level GPO object, but how do I enable that specific setting?
2) Set-GPRegistryValue might be the right tool, but I cannot find any documentation on the values I need to supply to its parameters (-Name -Key -ValueName -Type -Value) to enable "Audit user account logons" -- both Successes and Failures.
One can manually modify this setting using the Group Policy Management console GUI on the domain controller, but I am trying to upgrade my professional work habits to use stored scripts, rather than unrecorded point & clicks, so that my actions are repeatable
and documented.
Any pointers to documentation or an example would be welcome. I originally posted this question in the TechNet PowerShell Forum this afternoon, but someone recommended I copy it to the TechNet Group Policy Forum.
Jeffrey - New Orleans MCITP Enterprise Administrator, Virtualization Administrator

Answer 1

Hi Jeffrey,
>>One can manually modify this setting using the Group Policy Management console GUI on the domain controller, but I am trying to upgrade my professional work habits to use stored scripts, rather than unrecorded point & clicks, so that my actions
are repeatable and documented.
Before going further, although you have expressed that you don't want to use GPMC GUI to configure the audit setting, in fact, it's an easy and comparatively handy method to set the setting. Besides, based on the description, you
want to use PowerShell to do this. However, as far as I know, PowerShell can configure registry-based policy settings and Group Policy Preferences Registry settings, but audit policy security settings are not registry keys.
Nonetheless, if we really don't want to use GPMC console to do this, we can use Auditpol.exe to set the audit setting.
Regarding this point, the following article can be referred to for more information.
Auditpol
https://technet.microsoft.com/en-in/library/cc731451.aspx
Auditpol set
https://technet.microsoft.com/en-in/library/cc755264.aspx
In addition, regarding Group Policy Cmdlets in Windows PowerShell, the following article can be referred to for more information.
Group Policy Cmdlets in Windows PowerShell
https://technet.microsoft.com/en-us/library/ee461027.aspx
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen