cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
abarker5
Engaged Sweeper II
I know Lansweeper scans the standard Windows event logs, but I would like to also be able to gather events from the "Applications and Services" logs in the event viewer. One log I want to get events from is the AppLocker EXE and DLL log which is located at %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx

Has anyone figured out how to get Lansweeper to read those logs?
5 REPLIES 5
Wirkss
Engaged Sweeper
What you can do for applocker is use the installer packages and send the following command to the computer you want to audit:

powershell -Command "Get-AppLockerFileInformation -EventLog -EventType Audited -Statistics > \\put\a\shared\location\%username%.txt"

I know it is not optimum but at least you can get the audit result of not allowed apps from AppLocker
jonbtx
Engaged Sweeper
Me too, would like AppLocker logs
Jockeman
Engaged Sweeper II
I'm also looking for the AppLocker, and hope support will come soon!
abarker5
Engaged Sweeper II
Thank you. Many Microsoft Windows applications, such as SharePoint, store their events in those logs. This would be a very valuable enhancement to Lansweeper.
Hemoco
Lansweeper Alumni
Currently it is impossible to read the events logs that are in that file. But we have added this to our wishlist but we cannot assure you that this is going to be implemented. This is because we receive so many feature requests.