Table 1: Auditusr Include and Exclude Commands
Command Description
/is Include (report on) success events for the security principal, even if global auditing isn't enabled for the audit category.
/es Exclude (don't report on) success events for the security principal, even if global auditing is enabled for the audit category.
/if Include (report on) failure events for the security principal, even if global auditing isn't enabled for the audit category.
/ef Exclude (don't report on) failure events for the security principal, even if global auditing is enabled for the audit category.