0

Currently my network (Windows Server 2008 R2) operates on an application white list group policy (Run only specified Windows applications). Occasionally I'll run into a program where even after I've white listed all of the .exe's I can see, I still get a group policy error message to popping up on a users computer. (Users are running Windows 7)

Is there a tool or logging available where I can see what exactly "tripped" the group policy when trying to run a certain application?

This post is almost what I'm looking for: How to know when group policy blocked an application but the listed event ID (or anything similar) does not appear in my server logs so I'm guessing the logging has changed for Server 2008?

4-26 Edit I am not using AppLocker yet, I'm actually using a group policy (Run only specified Windows applications)

4-28 Edit The only approach I've found that works is using the Process Monitor program and going through the list of every executable running right as the error message comes up. Is this really not logged anywhere? Even locally on the machine?

1 Answer 1

0

You are probably using AppLocker, which has its own event log.

Application and Services Logs
    Microsoft
        Windows
            AppLocker

It logs events in there when programs are blocked from running by AppLocker.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .