Event ID | Level | Event message | Description |
---|---|---|---|
8000 | Error | Application Identity Policy conversion failed. Status *<%1> * | Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes. |
8001 | Information | The AppLocker policy was applied successfully to this computer. | Indicates that the AppLocker policy was successfully applied to the computer. |
8002 | Information | *<File name> * was allowed to run. | Specifies that the .exe or .dll file is allowed by an AppLocker rule. |
8003 | Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Applied only when the Audit only enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the Enforce rules enforcement mode were enabled. |
8004 | Error | *<File name> * was not allowed to run. | Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run. |
8005 | Information | *<File name> * was allowed to run. | Specifies that the script or .msi file is allowed by an AppLocker rule. |
8006 | Warning | *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. | Applied only when the Audit only enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the Enforce rules enforcement mode were enabled. |
8007 | Error | *<File name> * was not allowed to run. | Access to <file name> is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run. |
8008 | Error | AppLocker disabled on the SKU. | Added in Windows Server 2012 and Windows 8. |
8020 | Information | Packaged app allowed. | Added in Windows Server 2012 and Windows 8. |
8021 | Information | Packaged app audited. | Added in Windows Server 2012 and Windows 8. |
8022 | Information | Packaged app disabled. | Added in Windows Server 2012 and Windows 8. |
8023 | Information | Packaged app installation allowed. | Added in Windows Server 2012 and Windows 8. |
8024 | Information | Packaged app installation audited. | Added in Windows Server 2012 and Windows 8. |
8025 | Warning | Packaged app installation disabled. | Added in Windows Server 2012 and Windows 8. |
8027 | Warning | No Packaged app rule configured. | Added in Windows Server 2012 and Windows 8. |