System32
Sysmon
Events
Compliance
Validator
TLS/SSL
GeoIP
Tools
AppLocker Events
Source
AppLocker
(7)
Category
Tags
Warning
(7)
AppLocker
All AppLocker events
EventSentry
All EventSentry events
Security
All Windows Security events
Sysmon
All Sysmon events
ID
Event Message
8003
*[File name]* was allowed to run but would have been prevented from running if the AppLocker policy was enforced.
Warning
8006
*[File name]* was allowed to run but would have been prevented from running if the AppLocker policy was enforced.
Warning
8025
Packaged app installation disabled.
Warning
8027
No Packaged app rule configured.
Warning
8028
* was allowed to run but would have been prevented if the Config CI policy was enforced.
Warning
8033
ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit AppLocker Policy.
Warning
8039
* passed Config CI policy and was allowed to run
Warning