Home / server / Questions / 698191
In Process
Matthew Halliday
Asked: 2015-06-11 21:42:52 +0800 CST

Change an Applications and Services Logs log path using GPO

  • 772

I am wanting to change the AppLocker Log path by a GPO. The specific log is found at Event Viewer \ Applications and Services Logs \ Microsoft \ Windows \ AppLocker \ EXE and DLL.

I know you can change Application, Security, Setup, and System by setting Computer Configuration \ Administrative Templates \ Windows Components \ Event Log Service, but I can find one for the below section.

Manually changing isn't an option since we are using Citrix Provisioning Services and don't want to save it into the image.

group-policy

1 Answers

  1. According to this link it is not actually possible to change the path of the AppLocker log file.

    The suggested answer from the Microsoft moderator seems to be to utilize Event Forwarding and Collecting. At least one achieves a degree of flexibility in the adding of a new location for the same log events.

    • 1