How can I view the AppLocker events on client computers?
To view AppLocker events, you can use event forwarding technologies, Event Viewer (eventvwr.msc), or the Get-WinEvent Windows PowerShell cmdlet. You can either use Remote Desktop to log on to a client computer or physically log on to that computer to view or collect the AppLocker events. In Event Viewer, AppLocker events are stored in a log under: Applications and Services Logs\Microsoft\Windows\AppLocker. There are two child logs: one for executable files and DLLs and another for Windows Installer files and scripts.
