Reviewing AppLocker Logs on iOS 9 Devices

AppLocker is a powerful security feature that helps you monitor and control application usage on your organization's devices. In order to review the AppLocker logs, you can use Event Viewer. This article will guide you through the process of reviewing AppLocker logs and provide information about what to look for in these logs.

Why Review AppLocker Logs?

Reviewing AppLocker logs is an essential part of ensuring that your organization's devices are secure and compliant with your policies. The logs contain detailed information about applications that are affected by AppLocker rules, including the security identifier (SID) of the user or group identified in the rule, the rule type (path, file hash, or publisher), whether the file or packaged app is allowed or blocked, which packaged app is affected and the package identifier of the app, and which file is affected and the path of that file.

How to Review AppLocker Logs

To review AppLocker logs, follow these steps:

1. Open Event Viewer on your device.

2. In the left-hand menu, click on 'Windows Logs' and then select 'AppLocker'.

3. In the right-hand pane, you will see a list of events that have been logged by AppLocker.

4. You can use the filters at the top of the window to narrow down the list of events by date, time, or severity level.

What to Look for in AppLocker Logs

When reviewing AppLocker logs, there are several things you should look for:

* Security identifiers (SIDs) that do not match your organization's policies. This could indicate that an unauthorized user has accessed a device.

* Events that indicate a file or packaged app has been blocked by AppLocker. This could be due to a misconfigured rule or a malicious application.

* Events that indicate a file or packaged app has been allowed by AppLocker. This could be due to a legitimate business requirement.

Reviewing AppLocker logs is an important part of ensuring the security and compliance of your organization's devices. By following the steps outlined in this article, you can easily review AppLocker logs and identify any potential issues with your device policies.

Applocker ios 9