diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md index 9d03415f49..d0aa573b21 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md @@ -61,18 +61,23 @@ For both event subscriptions and local events, you can use the **Get-AppLockerFi Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. ->**Note:**  If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file. +> [!NOTE] +> If the AppLocker logs are not on your local device, you will need permission to view the logs. If the output is saved to a file, you will need permission to read that file. **To review AppLocker events with Get-AppLockerFileInformation** 1. At the command prompt, type **PowerShell**, and then press ENTER. 2. Run the following command to review how many times a file would have been blocked from running if rules were enforced: - `Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics` + ```powershell + Get-AppLockerFileInformation –EventLog –EventType Audited –Statistics + ``` 3. Run the following command to review how many times a file has been allowed to run or prevented from running: - `Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics` + ```powershell + Get-AppLockerFileInformation –EventLog –EventType Allowed –Statistics + ``` ### View the AppLocker Log in Event Viewer