Generating Blocked WDAC Event Logs on Endpoint

Use this task to extract Windows Defender Application Control (WDAC) / App Control block events from the endpoint's event logs for both audit and enforced modes and generate a structured JSON report for analysis.

About this task

The task performs the following actions:
  • Collects events from:
    • Microsoft-Windows-CodeIntegrity/Operational
    • Microsoft-Windows-AppLocker/MSI and Script
  • Filters for block-related event IDs:
    • Audit mode (would be blocked): 3076, 3034, 8028
    • Enforced mode (blocked): 3077, 3033, 8029, 8040
  • Applies a configurable time frame of 1 to 14 days.
  • Extracts the following key event details:
    • Timestamp
    • Event ID
    • Mode (Audit / Enforced)
    • Log source
    • Machine name
    • User SID
    • Event message
  • Outputs the results as a structured JSON file to BAC\WDAC_Reports\WDAC_Blocked_Events.json file.
  • Writes the execution logs to the BAC\Logs\WDAC_Blocked_Events.log file.
Refer to the table below to know more about the task's exit code.
Table 1. Exit Codes Table
Exit Code Meaning
0 Success
10 Invalid time frame
20 BAC path not found
30 Event query failure
40 No events found
50 Report generation failure
Figure 1. Task: Generate Blocked WDAC Event Logs on Endpoint

Generate Blocked WDAC Event Logs on Endpoint v2.0

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Generate Blocked WDAC Event Logs on Endpoint v2.0.
  3. From the Task: Generate Blocked WDAC Event Logs on Endpoint v2.0 pane, under Configuration Options, enter the following information:


    Table 2. Task: Generate Blocked WDAC Event Logs on Endpoint v2.0 Configuration Options
    Field Name Description
    Timeframe (Days) Number of days for which the event logs will be generated.
  4. From the Task: Generate Blocked WDAC Event Logs on Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

A successful execution of this task results in the following outcomes:
  • WDAC block events, both audit and enforced are extracted.
  • Clean, structured JSON report is generated in the BAC folder.
  • Data ready for ingestion into dashboards, analysis, or for BigFix® reporting.