windows-itpro-docs/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md

title, description, keywords, ms.assetid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, audience, ms.collection, author, ms.reviewer, ms.author, manager, ms.date

title	description	keywords	ms.assetid	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.localizationpriority	audience	ms.collection	author	ms.reviewer	ms.author	manager	ms.date
Managing and troubleshooting Windows Defender Application Control policies (Windows 10)	Gather information about how your deployed Windows Defender Application Control policies are behaving.	whitelisting, security, malware	8d6e0474-c475-411b-b095-1c61adb2bdbb	w10	deploy	library	security	medium	ITPro	M365-security-compliance	jsuther1974	isbrahm	dansimp	dansimp	03/16/2020

Windows Defender Application Control operational guide

Applies to

• Windows 10
• Windows Server 2016

After designing and deploying your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they are not behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender Advanted Threat Protection (MDATP) Advanced Hunting feature.

WDAC Events Overview

WDAC generates and logs events when a policy is loaded as well as when a binary attempts to execute and is blocked. These events include information that identifies the policy and gives more details about the block. Generally, WDAC does not generate events when a binary is allowed; however, there is the option to enable allow events when Managed Installer and/or the Intelligent Security Graph (ISG) is configured.

WDAC events are generated under two locations:

1. Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
2. Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script

In this section

Topic	Description
Understanding Application Control events	This topic explains the meaning of different WDAC events.
Query WDAC events with Advanced hunting	This topic covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender ATP.