splunk-security_content/lookups/csv/applockereventcodes.csv

1	EventCode	Description
2	8000	AppID policy conversion failed. Status * <%1> * Indicates that the policy wasn't applied correctly to the computer. The status message is provided for troubleshooting purposes.
3	8001	The AppLocker policy was applied successfully to this computer. Indicates that the AppLocker policy was successfully applied to the computer.
4	8002	*<File name> * was allowed to run. Indicates an AppLocker rule allowed the .exe or .dll file.
5	8003	*<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Shown only when the Audit only enforcement mode is enabled. Indicates that the AppLocker policy would block the .exe or .dll file if the enforcement mode setting was Enforce rules.
6	8004	*<File name> * was prevented from running. AppLocker blocked the named EXE or DLL file. Shown only when the Enforce rules enforcement mode is enabled.
7	8005	*<File name> * was allowed to run. Indicates an AppLocker rule allowed the script or .msi file.
8	8006	*<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Shown only when the Audit only enforcement mode is enabled. Indicates that the AppLocker policy would block the script or .msi file if the Enforce rules enforcement mode was enabled.
9	8007	*<File name> * was prevented from running. AppLocker blocked the named Script or MSI. Shown only when the Enforce rules enforcement mode is enabled.
10	8008	*<File name> *: AppLocker component not available on this SKU. Indicates an edition of Windows that doesn't support AppLocker.
11	8020	*<File name> * was allowed to run. Added in Windows Server 2012 and Windows 8.
12	8021	*<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Added in Windows Server 2012 and Windows 8.
13	8022	*<File name> * was prevented from running. Added in Windows Server 2012 and Windows 8.
14	8023	*<File name> * was allowed to be installed. Added in Windows Server 2012 and Windows 8.
15	8024	*<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced. Added in Windows Server 2012 and Windows 8.
16	8025	*<File name> * was prevented from running. Added in Windows Server 2012 and Windows 8.
17	8027	No packaged apps can be executed while Exe rules are being enforced and no Packaged app rules have been configured. Added in Windows Server 2012 and Windows 8.
18	8028	*<File name> * was allowed to run but would have been prevented if the Config CI policy were enforced. Added in Windows Server 2016 and Windows 10.
19	8029	*<File name> * was prevented from running due to Config CI policy. Added in Windows Server 2016 and Windows 10.
20	8030	ManagedInstaller check SUCCEEDED during Appid verification of * Added in Windows Server 2016 and Windows 10.
21	8031	SmartlockerFilter detected file * being written by process * Added in Windows Server 2016 and Windows 10.
22	8032	ManagedInstaller check FAILED during Appid verification of * Added in Windows Server 2016 and Windows 10.
23	8033	ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit AppLocker Policy. Added in Windows Server 2016 and Windows 10.
24	8034	ManagedInstaller Script check FAILED during Appid verification of * Added in Windows Server 2016 and Windows 10.
25	8035	ManagedInstaller Script check SUCCEEDED during Appid verification of * Added in Windows Server 2016 and Windows 10.
26	8036	* was prevented from running due to Config CI policy Added in Windows Server 2016 and Windows 10.
27	8037	* passed Config CI policy and was allowed to run. Added in Windows Server 2016 and Windows 10.
28	8038	Publisher info: Subject: * Issuer: * Signature index * (* total) Added in Windows Server 2016 and Windows 10.
29	8039	Package family name * version * was allowed to install or update but would have been prevented if the Config CI policy Added in Windows Server 2016 and Windows 10.
30	8040	Package family name * version * was prevented from installing or updating due to Config CI policy Added in Windows Server 2016 and Windows 10.