locked
Applocker event log entries - FileHash entry blank RRS feed

  • Question

  • We are looking into collecting Applocker error events for review/white listing.

    In our environment, we aren't seeing the FileHash property being populated within the Event Log (see image)

    Is this normal on Windows 10? (Devices are running Win 10 Ent 1709). Or is there a way to enhance the client logging (I've yet to find anything on this from Google)?

    Get-AppLockerFileInformation cmdlet returns the filehash info as expected.


    Monday, September 30, 2019 8:02 PM

All replies

  • Yes.

    See:

    https://docs.microsoft.com/en-us/powershell/module/applocker/get-applockerfileinformation?view=win10-ps


    S.Sengupta,Microsoft MVP Windows and Devices for IT, Windows Insider MVP

    Monday, September 30, 2019 11:51 PM
  • It's normal.

    Best Regards,


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, October 1, 2019 3:51 PM