Event log scanning for Applications and Services Logs

[abarker5]

I know Lansweeper scans the standard Windows event logs, but I would like to also be able to gather events from the "Applications and Services" logs in the event viewer. One log I want to get events from is the AppLocker EXE and DLL log which is located at %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx

Has anyone figured out how to get Lansweeper to read those logs?

[Wirkss]

What you can do for applocker is use the installer packages and send the following command to the computer you want to audit:

powershell -Command "Get-AppLockerFileInformation -EventLog -EventType Audited -Statistics > \\put\a\shared\location\%username%.txt"

I know it is not optimum but at least you can get the audit result of not allowed apps from AppLocker

[jonbtx]

Me too, would like AppLocker logs

[Jockeman]

I'm also looking for the AppLocker, and hope support will come soon!

[abarker5]

Thank you. Many Microsoft Windows applications, such as SharePoint, store their events in those logs. This would be a very valuable enhancement to Lansweeper.

[Hemoco]

Currently it is impossible to read the events logs that are in that file. But we have added this to our wishlist but we cannot assure you that this is going to be implemented. This is because we receive so many feature requests.