Export (0) Print
Expand All
7 out of 12 rated this helpful - Rate this topic

View the AppLocker Log in Event Viewer

Updated: November 9, 2009

Applies To: Windows 7, Windows Server 2008 R2

This topic describes the steps to view AppLocker policy events that are written to the AppLocker logs by using Event Viewer.

When AppLocker policy enforcement is set to Enforce rules, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to Audit only, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

  1. Open Event Viewer. To do this, click Start, type eventvwr.msc in the Search programs and files box, and then press ENTER.

  2. In the console tree under Application and Services Logs\Microsoft\Windows, double-click AppLocker.

AppLocker events are listed in either the EXE and DLL log or the MSI and Script log. Event information includes the enforcement setting, file name, date and time, and user name. The logs can be exported to other file formats for further analysis.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.